High severity · published Apr 22, 2026
CVE-2026-41172
Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as an asset. Version 7.23.0 contains a fix.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
squidex · Squidex
< 7.23.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41172
github.com
https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
github.com
https://github.com/Squidex/squidex/security/advisories/GHSA-x7cq-4f4c-8qcv
More from squidex
8.8
CVE-2026-24736
Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration
7.3
CVE-2026-41171
SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient
7.2
CVE-2026-41170
Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
5.5
CVE-2026-41177
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction