{"schema":"threatline.record/2","record":{"id":"CVE-2026-112991","aliases":[],"summary":"MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()","details":"The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.","categories":["Unclassified"],"product":"misp-modules","vendor":"MISP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112991","source_modified_at":"2026-10-20T19:22:15.189Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"misp-modules","vendor":"MISP","versions":[{"lessThanOrEqual":"3.0.12","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00312,"percentile":0.22937,"score_date":"2026-10-23"},"published_at":"2026-10-19T22:19:50.011Z","modified_at":"2026-10-20T19:22:15.189Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112991","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T19:22:15.189Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112991","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T19:22:04.700266Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T19:22:15.189Z","content_hash":"b1a0819048b859545a82347f94254291acc2374b67ab68dc1196e16e05ca8786"}}