CVE-2026-100391

EUVD-2026-87328
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/mhdzumair/mediaflow-proxy
https://github.com/mhdzumair/mediaflow-proxy/blob/2.4.9/mediaflow_proxy/routes/proxy.py#L532-L569
https://github.com/mhdzumair/mediaflow-proxy/commit/99f4af1153d4766420a098a232183cba1efdc560
https://www.vulncheck.com/advisories/mediaflow-proxy-through-2.4.9-server-side-request-forgery-via-incomplete-validation