CVE-2026-91081 in Docs
Summary
by MITRE • 09/14/2026
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The identified security flaw resides within the cors-proxy endpoint of Docs software versions up through 5.6.1, representing a critical server-side request forgery vulnerability that enables unauthorized outbound network requests from the application server. This specific implementation allows anonymous attackers to initiate these requests by supplying a public document UUID as an input parameter rather than directly specifying target URLs in traditional SSRF patterns. The architectural design of this endpoint appears intended to facilitate cross-origin resource sharing for legitimate client-side operations, but it fails to adequately restrict or validate the destination addresses generated during proxying processes. By leveraging the provided document identifier, which is typically associated with internal storage paths or backend service endpoints, attackers can manipulate the underlying request resolution logic to redirect traffic toward arbitrary destinations within the organization's network infrastructure.
The exploitation mechanism relies heavily on advanced techniques such as DNS time-of-check-time-of-use race conditions and shared address space bypasses to circumvent standard security controls. In a typical SSRF mitigation scenario, developers often implement allowlists or block private IP ranges at the point of validation before making the actual request. However, in this vulnerability class, there is likely a window between the initial validation check and the subsequent network connection establishment where an attacker can influence the DNS resolution outcome. By rapidly changing DNS records to resolve domain names to internal IP addresses during this narrow time window, attackers can bypass static allowlists that only verify public or safe domains at the moment of input submission. Additionally, shared address space bypasses may be employed if the application runs in environments where IPv6 and IPv4 mappings overlap or when specific encoding tricks are used to obscure private IP ranges from simple regex-based filters.
The operational impact of this vulnerability is severe as it effectively turns the Docs server into a pivot point for lateral movement within the internal network. Attackers can access sensitive internal services that are not exposed to the public internet, such as database management interfaces, administrative dashboards, or other microservices running on localhost or private subnets. Furthermore, the ability to exfiltrate image content indicates that the vulnerability supports data retrieval operations beyond simple connectivity testing. This means an attacker could potentially read files from internal file systems, scrape configuration details, or extract proprietary information stored within documents and associated media assets. The combination of outbound request capability with data extraction features elevates this from a mere reconnaissance tool to a significant vector for data breach and intellectual property theft.
From a classification perspective, this vulnerability aligns closely with CWE-918 Server-Side Request Forgery (SSRF), specifically involving the abuse of proxy functionality to bypass access controls. It also relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization for Race Conditions, given the reliance on TOCTOU attacks against DNS resolution mechanisms. In terms of adversary tactics, this exploitation path maps directly to ATT&CK technique T1571 Non-Standard Port and potentially T1090 Proxy as attackers use the compromised server to mask their origin while accessing internal resources. The lack of authentication requirements for exploiting this flaw further exacerbates the risk, allowing any internet-facing user with knowledge of a valid document UUID to launch attacks without prior credentials or privileges.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Organizations should immediately upgrade to version 5.6.2 or later where this vulnerability has been patched by enforcing stricter validation on the resolved IP addresses rather than just the input parameters. Implementing egress filtering at the network perimeter is crucial, ensuring that only necessary outbound connections are permitted from application servers and blocking access to private RFC1918 address ranges unless explicitly required for business logic. Additionally, developers should avoid relying solely on DNS-based validation due to TOCTOU risks; instead, they should resolve hostnames securely within a controlled environment or use allowlists of specific internal service endpoints that the proxy is authorized to reach. Input sanitization must also be enhanced to detect and reject attempts to encode private IP addresses using hexadecimal, octal, or other obfuscation techniques commonly used in shared address space bypasses. Regular security audits focusing on server-side request handling components will help identify similar patterns before they can be exploited by malicious actors seeking internal network access.