CVE-2026-125367

EUVD-2026-120530
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Common Weakness Enumeration
References
https://github.com/picosh/pico
https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
https://github.com/picosh/pico/commit/48a85d6
https://github.com/picosh/pico/issues/229
https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command