CVE-2026-19352

mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

Published Aug 9, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mifi

lossless-cut

affected

Version	Status	Constraints
`3.0`	affected	—
`3.1`	affected	—
`3.2`	affected	—
`3.3`	affected	—
`3.4`	affected	—
`3.5`	affected	—
`3.6`	affected	—
`3.7`	affected	—
`3.8`	affected	—
`3.9`	affected	—
`3.10`	affected	—
`3.11`	affected	—
`3.12`	affected	—
`3.13`	affected	—
`3.14`	affected	—
`3.15`	affected	—
`3.16`	affected	—
`3.17`	affected	—
`3.18`	affected	—
`3.19`	affected	—
`3.20`	affected	—
`3.21`	affected	—
`3.22`	affected	—
`3.23`	affected	—
`3.24`	affected	—
`3.25`	affected	—
`3.26`	affected	—
`3.27`	affected	—
`3.28`	affected	—
`3.29`	affected	—
`3.30`	affected	—
`3.31`	affected	—
`3.32`	affected	—
`3.33`	affected	—
`3.34`	affected	—
`3.35`	affected	—
`3.36`	affected	—
`3.37`	affected	—
`3.38`	affected	—
`3.39`	affected	—
`3.40`	affected	—
`3.41`	affected	—
`3.42`	affected	—
`3.43`	affected	—
`3.44`	affected	—
`3.45`	affected	—
`3.46`	affected	—
`3.47`	affected	—
`3.48`	affected	—
`3.49`	affected	—
`3.50`	affected	—
`3.51`	affected	—
`3.52`	affected	—
`3.53`	affected	—
`3.54`	affected	—
`3.55`	affected	—
`3.56`	affected	—
`3.57`	affected	—
`3.58`	affected	—
`3.59`	affected	—
`3.60`	affected	—
`3.61`	affected	—
`3.62`	affected	—
`3.63`	affected	—
`3.64`	affected	—
`3.65`	affected	—
`3.66`	affected	—
`3.67`	affected	—
`3.68`	affected	—
`3.69.0`	affected	—

No data.

Vendor Product Versions

Mifi

Lossless-cut

Version	Status	Scheme	Platform
`3.0`	affected	generic	—
`3.1`	affected	generic	—
`3.2`	affected	generic	—
`3.3`	affected	generic	—
`3.4`	affected	generic	—
`3.5`	affected	generic	—
`3.6`	affected	generic	—
`3.7`	affected	generic	—
`3.8`	affected	generic	—
`3.9`	affected	generic	—
`3.10`	affected	generic	—
`3.11`	affected	generic	—
`3.12`	affected	generic	—
`3.13`	affected	generic	—
`3.14`	affected	generic	—
`3.15`	affected	generic	—
`3.16`	affected	generic	—
`3.17`	affected	generic	—
`3.18`	affected	generic	—
`3.19`	affected	generic	—
`3.20`	affected	generic	—
`3.21`	affected	generic	—
`3.22`	affected	generic	—
`3.23`	affected	generic	—
`3.24`	affected	generic	—
`3.25`	affected	generic	—
`3.26`	affected	generic	—
`3.27`	affected	generic	—
`3.28`	affected	generic	—
`3.29`	affected	generic	—
`3.30`	affected	generic	—
`3.31`	affected	generic	—
`3.32`	affected	generic	—
`3.33`	affected	generic	—
`3.34`	affected	generic	—
`3.35`	affected	generic	—
`3.36`	affected	generic	—
`3.37`	affected	generic	—
`3.38`	affected	generic	—
`3.39`	affected	generic	—
`3.40`	affected	generic	—
`3.41`	affected	generic	—
`3.42`	affected	generic	—
`3.43`	affected	generic	—
`3.44`	affected	generic	—
`3.45`	affected	generic	—
`3.46`	affected	generic	—
`3.47`	affected	generic	—
`3.48`	affected	generic	—
`3.49`	affected	generic	—
`3.50`	affected	generic	—
`3.51`	affected	generic	—
`3.52`	affected	generic	—
`3.53`	affected	generic	—
`3.54`	affected	generic	—
`3.55`	affected	generic	—
`3.56`	affected	generic	—
`3.57`	affected	generic	—
`3.58`	affected	generic	—
`3.59`	affected	generic	—
`3.60`	affected	generic	—
`3.61`	affected	generic	—
`3.62`	affected	generic	—
`3.63`	affected	generic	—
`3.64`	affected	generic	—
`3.65`	affected	generic	—
`3.66`	affected	generic	—
`3.67`	affected	generic	—
`3.68`	affected	generic	—
`3.69.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Adjacent Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.298% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mifi/lossless-cut/
https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0a
https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFe
https://vuldb.com/cve/CVE-2026-19352
https://vuldb.com/submit/865910
https://vuldb.com/vuln/387191
https://vuldb.com/vuln/387191/cti

History

Aug 10, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 9, 2026 12:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
Title		mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
First Time appeared		Mifi Mifi lossless-cut
Weaknesses		CWE-918
CPEs		cpe:2.3:a:mifi:lossless-cut::::::::
Vendors & Products		Mifi Mifi lossless-cut
References		https://github.com/mifi/lossless-cut/ https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0a https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFe https://vuldb.com/cve/CVE-2026-19352 https://vuldb.com/submit/865910 https://vuldb.com/vuln/387191 https://vuldb.com/vuln/387191/cti
Metrics		cvssV2_0 `{'score': 1.8, 'vector': 'AV:A/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.1, 'vector': 'CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`