CVE-2026-110628

EUVD-2026-101256
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/kanbn/kan
https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27
https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52
https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
https://github.com/kanbn/kan/pull/590
https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg
https://hackmd.io/@leediay/HyIxU63ofg
https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment