CVE-2026-111662

EUVD-2026-103084
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31.85%
Common Weakness Enumeration
References
https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/oembed_controller.rb#L8-L11
https://github.com/chaskiq/chaskiq/blob/2.0.3/app/services/fetch_link_card_service.rb#L11-L40
https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload
https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-unauthenticated-ssrf-via-oembed-endpoint
https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload