dfpc-coe CloudTAK up to 13.22.0 Basemap Import api/routes/basemap.ts importBasemapURL redirect

Summaryinfo

A vulnerability labeled as problematic has been found in dfpc-coe CloudTAK up to 13.22.0. This vulnerability affects the function importBasemapURL of the file api/routes/basemap.ts of the component Basemap Import. Such manipulation leads to redirect. This vulnerability is referenced as CVE-2026-54546. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in dfpc-coe CloudTAK up to 13.22.0. Affected by this issue is the function importBasemapURL of the file api/routes/basemap.ts of the component Basemap Import. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. CVE summarizes:

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() in api/routes/basemap.ts to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL in api/lib/interface-basemap.ts checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure. This issue is fixed in version 13.22.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54546 since 06/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1204.001.

Upgrading to version 13.22.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Cloud Software

Vendor

• dfpc-coe

Name

• CloudTAK

Version

• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 13.12
• 13.13
• 13.14
• 13.15
• 13.16
• 13.17
• 13.18
• 13.19
• 13.20
• 13.21
• 13.22.0

Website

• Product: https://github.com/dfpc-coe/CloudTAK/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion