CVE-2026-125359

EUVD-2026-120522
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.35%
Common Weakness Enumeration
References
https://github.com/fancydirty/mediary-scout
https://github.com/fancydirty/mediary-scout/blob/v2026.10.29/apps/web/lib/pansou-probe.ts#L18-L34
https://github.com/fancydirty/mediary-scout/commit/9cb9ab5eea492bc8f61f5c4d63f9c6b6800f7e1f
https://github.com/fancydirty/mediary-scout/issues/366
https://github.com/fancydirty/mediary-scout/releases/tag/v2026.11.05
https://www.vulncheck.com/advisories/mediary-scout-before-2026.11.05-ssrf-via-pansou-search-source-setting