xibosignage xibo-cms up to 4.4.0 server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in xibosignage xibo-cms up to 4.4.0. Impacted is an unknown function. Such manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2026-31955. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in xibosignage xibo-cms up to 4.4.0 and classified as critical. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include "Add DataSet" button to allow for additional DataSets to be created independently to Layouts. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-31955 since 03/10/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.4.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25366). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• xibosignage

Name

• xibo-cms

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

Website

• Product: https://github.com/xibosignage/xibo-cms/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion