{"id":"CVE-2026-111720","title":"fish-island-backend through commit 7c61b78 SSRF via /api/web/parse","summary":"fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. At…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"lhccong","product":"fish-island-backend","affected":["fish-island-backend <= 7c61b7861e99d3970beb34103c244b79e4de7d88"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T14:10:38.316936Z"},"exploitAvailable":true,"published":"2026-10-16","updated":"2026-10-19","sourceUpdated":"2026-10-19T14:13:29.044Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111720","references":[{"url":"https://hackmd.io/@hieuPenguinnn/fish-island-web-parse-unauth-ssrf"},{"url":"https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/service/impl/chat/WebParserServiceImpl.java#L28-L45"},{"url":"https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/controller/chat/WebParserController.java#L13-L25"},{"url":"https://github.com/lhccong/fish-island-backend/blob/7c61b7861e99d3970beb34103c244b79e4de7d88/src/main/java/com/cong/fishisland/config/CorsConfig.java#L33"},{"url":"https://www.vulncheck.com/advisories/fish-island-backend-through-commit-7c61b78-ssrf-via-api-web-parse","label":"VulnCheck Advisory: fish-island-backend through commit 7c61b78 SSRF via /api/web/parse"}],"tags":["cve.org","exploit-available"],"epss":0.00384,"epssPercentile":0.3226,"ingestedAt":"2026-10-16T18:43:08.638Z","slug":"CVE-2026-111720","body":"## Overview\n\nfish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.\n\n## Affected\n\n- `fish-island-backend <= 7c61b7861e99d3970beb34103c244b79e4de7d88`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":224959,"id":"CVE-2026-111720","ts":1792420237679,"field":"exploit_available","old":"false","new":"true"}]}