once-campfire vulnerabilities

CVEs whose affected-version data names the once-campfire package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-100355Low· 3.1

1w ago

Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#p…

▾ Sunlitbasecamp · once-campfireEPSS 0.28%via CVEORG