CVE-2026-47170

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47170", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-18T21:25:34.497Z", "datePublished": "2026-06-11T18:38:46.120Z", "dateUpdated": "2026-06-13T02:34:22.026Z"}, "containers": {"cna": {"title": "Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r"}, {"name": "https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5", "tags": ["x_refsource_MISC"], "url": "https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5"}], "affected": [{"vendor": "garlic-signage", "product": "garlic-hub", "versions": [{"version": "< 1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T18:38:46.120Z"}, "descriptions": [{"lang": "en", "value": "Garlic-Hub manages digital signage network \u2014 devices, content, and playlists \u2014 from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1."}], "source": {"advisory": "GHSA-x24v-76hr-989r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-13T02:33:49.401029Z", "id": "CVE-2026-47170", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T02:34:22.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47170", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T02:33:49.401029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-13T02:34:17.625Z"}}], "cna": {"title": "Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint", "source": {"advisory": "GHSA-x24v-76hr-989r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "garlic-signage", "product": "garlic-hub", "versions": [{"status": "affected", "version": "< 1.1"}]}], "references": [{"url": "https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r", "name": "https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5", "name": "https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Garlic-Hub manages digital signage network \u2014 devices, content, and playlists \u2014 from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-11T18:38:46.120Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47170", "state": "PUBLISHED", "dateUpdated": "2026-06-13T02:34:22.026Z", "dateReserved": "2026-05-18T21:25:34.497Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-11T18:38:46.120Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "garlic-hub", "vendor": "garlic-signage", "versions": [{"status": "affected", "version": "< 1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Garlic-Hub manages digital signage network \u2014 devices, content, and playlists \u2014 from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly accessible media pool. This issue has been patched in version 1.1."}, {"lang": "es", "value": "Garlic-Hub gestiona la red de se\u00f1alizaci\u00f3n digital - dispositivos, contenido y listas de reproducci\u00f3n - desde una \u00fanica interfaz autoalojada. Antes de la versi\u00f3n 1.1, los usuarios autenticados pueden hacer que el servidor emita solicitudes HTTP arbitrarias a servicios internos a trav\u00e9s del endpoint uploadFromUrl. Esto permite el escaneo de puertos interno, la identificaci\u00f3n de servicios y la recuperaci\u00f3n de respuestas HTTP internas que se almacenan en el repositorio de medios de acceso p\u00fablico. Este problema ha sido parcheado en la versi\u00f3n 1.1."}], "id": "CVE-2026-47170", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47170", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-13T02:33:49.401029Z", "version": "2.0.3"}}]}, "published": "2026-06-11T19:16:44.890", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/garlic-signage/garlic-hub/commit/076b6d70a43d9641c35cbd8042353b473e3241f5"}, {"source": "security-advisories@github.com", "url": "https://github.com/garlic-signage/garlic-hub/security/advisories/GHSA-x24v-76hr-989r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "garlic-hub", "source": "cna", "vendor": "garlic-signage"}, "product": "garlic-hub", "vendor": "garlic-signage"}], "created": "2026-06-11T21:15:07.129588+00:00", "updated": "2026-06-12T20:21:50.519150+00:00", "vendors": ["garlic-signage", "garlic-signage$PRODUCT$garlic-hub"]}