CVE-2026-31955

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31955", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T15:10:10.658Z", "datePublished": "2026-04-24T00:14:15.950Z", "dateUpdated": "2026-04-25T01:40:15.137Z"}, "containers": {"cna": {"title": "Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-5q58-9vhx-xg2p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-5q58-9vhx-xg2p"}, {"name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1"}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"version": "< 4.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:14:15.950Z"}, "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include \"Add DataSet\" button to allow for additional DataSets to be created independently to Layouts. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}], "source": {"advisory": "GHSA-5q58-9vhx-xg2p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-25T01:40:06.113857Z", "id": "CVE-2026-31955", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:40:15.137Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31955", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-25T01:40:06.113857Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:40:10.978Z"}}], "cna": {"title": "Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality", "source": {"advisory": "GHSA-5q58-9vhx-xg2p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "xibosignage", "product": "xibo-cms", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "references": [{"url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-5q58-9vhx-xg2p", "name": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-5q58-9vhx-xg2p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "name": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include \"Add DataSet\" button to allow for additional DataSets to be created independently to Layouts. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:14:15.950Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31955", "state": "PUBLISHED", "dateUpdated": "2026-04-25T01:40:15.137Z", "dateReserved": "2026-03-10T15:10:10.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T00:14:15.950Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xibo-cms", "vendor": "xibosignage", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xibosignage:xibo:*:*:*:*:*:*:*:*", "matchCriteriaId": "57F53EFF-4DF3-46B8-B538-D4D852953280", "versionEndExcluding": "4.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. Exploitation of the vulnerability is possible on behalf of an authorized user who has both of the following privileges, which are not granted to non-admins as standard: Include \"Add DataSet\" button to allow for additional DataSets to be created independently to Layouts. Users should upgrade to version 4.4.1 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust."}, {"lang": "es", "value": "Xibo es una plataforma de se\u00f1alizaci\u00f3n digital de c\u00f3digo abierto con un sistema de gesti\u00f3n de contenido web y software de reproductor de pantalla para Windows. Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) autenticada en versiones anteriores a la 4.4.1 permite a los usuarios con permisos de DataSet realizar peticiones HTTP arbitrarias desde el servidor CMS a recursos de red internos o externos. Esto puede ser explotado para escanear infraestructura interna, acceder a puntos finales de metadatos de la nube local (p. ej., AWS IMDS), interactuar con servicios internos que carecen de autenticaci\u00f3n, o exfiltrar datos. La explotaci\u00f3n de la vulnerabilidad es posible en nombre de un usuario autorizado que tenga ambos de los siguientes privilegios, que no se conceden a los no administradores de forma est\u00e1ndar: Incluir el bot\u00f3n \u2019A\u00f1adir DataSet\u2019 para permitir que se creen DataSets adicionales de forma independiente a los Dise\u00f1os. Los usuarios deben actualizar a la versi\u00f3n 4.4.1, que corrige este problema. La actualizaci\u00f3n a una versi\u00f3n corregida es necesaria para remediarlo. Los usuarios que no puedan actualizar deben revocar dichos privilegios a los usuarios en los que no conf\u00eden."}], "id": "CVE-2026-31955", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31955", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-25T01:40:06.113857Z", "version": "2.0.3"}}]}, "published": "2026-04-24T01:16:11.623", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/xibosignage/xibo-cms/releases/tag/4.4.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-5q58-9vhx-xg2p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.1)"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "xibo-cms", "source": "cna", "vendor": "xibosignage"}, "product": "xibo", "vendor": "xibosignage"}], "analysis": {"en": {"generated_at": "2026-04-28T20:26:10.798662+00:00", "value": {"mitigation_remediation": ["Upgrade Xibo CMS to version 4.4.1 or later which contains the fix for this SSRF issue.", "If upgrading is not immediately possible, remove the \"Add DataSet\" privilege from any user who is not explicitly trusted; review and restrict DataSet permissions at the role level.", "Restrict outbound connections from the CMS server by implementing network segmentation or firewall rules that block access to internal or undesired external endpoints.", "Monitor CMS logs for unexpected outbound HTTP requests and investigate any anomalous behavior."], "summary": {"action": "Apply Patch", "impact": "Authenticated Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Xibo CMS from Xibo Signage, specifically all releases prior to version 4.4.1. The issue is tied to users with the DataSet permission and the ability to use the \"Add DataSet\" function. No other products or vendor versions are listed.", "description_and_impact": "An authenticated Server\u2011Side Request Forgery (SSRF) exists in the Remote DataSet functionality of Xibo CMS. Users possessing DataSet creation privileges can trigger the server to make arbitrary HTTP requests to any internal or external address. This capability enables coverage of internal network discovery, extraction of cloud metadata such as AWS IMDS, interaction with unauthenticated internal services, and potential exfiltration of sensitive data. The attack requires legitimate user credentials but bypasses the intended access boundaries of the CMS.", "risk_and_exploitability": "The CVSS score is 4.9, indicating low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires an authenticated user with the specific DataSet privilege, and the SSRF can be used to probe internal resources or other exposed services."}}}}, "created": "2026-04-28T08:45:26.976139+00:00", "updated": "2026-04-28T20:30:06.191486+00:00", "vendors": ["xibosignage", "xibosignage$PRODUCT$xibo"]}