ail-project AIL Framework up to 6.x Crawler server-side request forgery

Summaryinfo

A vulnerability was found in ail-project AIL Framework up to 6.x. It has been rated as problematic. This issue affects some unknown processing of the component Crawler. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-76164. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in ail-project AIL Framework up to 6.x. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component Crawler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can therefore be instructed to make direct HTTP(S) requests to addresses that should not be reachable by application users, including loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services such as 169.254.169.254. Manual crawler tasks bypass the existing domain blacklist because they are assigned a non-zero priority, and ordinary IP literals are classified as web targets and fetched directly rather than through Tor or another proxy. Consequently, an attacker can use the AIL server as a network pivot to access services available from the server's network context. Responses generated by these requests, including captured HTML, screenshots, and HAR data, can subsequently be accessed through the crawler interface. This makes the SSRF non-blind and may allow an attacker to disclose sensitive internal application data, service information, or cloud instance metadata and credentials. The patch introduces validation that resolves crawler destinations and rejects URLs resolving to non-global IP addresses, addressing localhost, private-network, and link-local targets.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-76164 since 08/19/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 7.0 eliminates this vulnerability. Applying the patch d7b60ff9e20ee493895430b1a7c63d498a8fd780 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-62366). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ail-project

Name

• AIL Framework

Version

• 6.x

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion