CVE-2026-49345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49345", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-29T14:35:45.903Z", "datePublished": "2026-06-19T19:23:22.858Z", "dateUpdated": "2026-06-22T14:01:57.576Z"}, "containers": {"cna": {"title": "Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6"}], "affected": [{"vendor": "sourcentis", "product": "mercator", "versions": [{"version": "< 2025.05.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T19:23:22.858Z"}, "descriptions": [{"lang": "en", "value": "Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue."}], "source": {"advisory": "GHSA-6q97-4q5r-96j6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T13:58:39.217300Z", "id": "CVE-2026-49345", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T14:01:57.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)", "source": {"advisory": "GHSA-6q97-4q5r-96j6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "sourcentis", "product": "mercator", "versions": [{"status": "affected", "version": "< 2025.05.19"}]}], "references": [{"url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6", "name": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-19T19:23:22.858Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49345", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T13:58:39.217300Z"}}}], "references": [{"url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-06-22T13:58:22.643Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-49345", "state": "PUBLISHED", "dateUpdated": "2026-06-19T19:23:22.858Z", "dateReserved": "2026-05-29T14:35:45.903Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-19T19:23:22.858Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mercator", "vendor": "sourcentis", "versions": [{"status": "affected", "version": "< 2025.05.19"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vulnerability exists in Mercator's CVE configuration panel (`/admin/config/parameters`). The `testProvider()` method in `ConfigurationController` passes user-supplied input directly to `curl_init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the Mercator server to issue arbitrary outbound network requests. The suffix `/api/dbInfo` appended to the URL can be bypassed by injecting a `#` fragment character (e.g. `http://TARGET/PATH#`), allowing full control over the target URL. No scheme whitelist, host whitelist, or private/loopback IP block is applied. The `telnet://` scheme can be used for internal port scanning; the `gopher://` scheme enables interaction with unauthenticated internal services (Redis, Memcached), potentially leading to Remote Code Execution under specific deployment conditions. Version 2025.05.19 patches the issue."}, {"lang": "es", "value": "Mercator es una aplicaci\u00f3n web de c\u00f3digo abierto que permite el mapeo del sistema de informaci\u00f3n. Antes de la versi\u00f3n 2025.05.19, una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) existe en el panel de configuraci\u00f3n CVE de Mercator (\u2019/admin/config/parameters\u2019). El m\u00e9todo \u2019testProvider()\u2019 en \u2019ConfigurationController\u2019 pasa la entrada proporcionada por el usuario directamente a \u2019curl_init()\u2019 sin validar el esquema, el nombre de host o la direcci\u00f3n IP de destino. Un usuario autenticado con el permiso \u2019configure\u2019 puede forzar al servidor Mercator a emitir peticiones de red salientes arbitrarias. El sufijo \u2019/api/dbInfo\u2019 a\u00f1adido a la URL puede ser omitido inyectando un car\u00e1cter de fragmento \u2019#\u2019 (p. ej., \u2019http://TARGET/PATH#\u2019), permitiendo el control total sobre la URL de destino. No se aplica ninguna lista blanca de esquemas, lista blanca de hosts o bloqueo de IP privadas/loopback. El esquema \u2019telnet://\u2019 puede ser utilizado para el escaneo interno de puertos; el esquema \u2019gopher://\u2019 permite la interacci\u00f3n con servicios internos no autenticados (Redis, Memcached), lo que podr\u00eda llevar a la ejecuci\u00f3n remota de c\u00f3digo bajo condiciones de despliegue espec\u00edficas. La versi\u00f3n 2025.05.19 corrige el problema."}], "id": "CVE-2026-49345", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49345", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T13:58:39.217300Z", "version": "2.0.3"}}]}, "published": "2026-06-19T20:16:18.663", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sourcentis/mercator/security/advisories/GHSA-6q97-4q5r-96j6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.05.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mercator", "source": "cna", "vendor": "sourcentis"}, "product": "mercator", "vendor": "sourcentis"}], "created": "2026-06-19T21:30:17.793163+00:00", "updated": "2026-06-19T22:15:03.318481+00:00", "vendors": ["sourcentis", "sourcentis$PRODUCT$mercator"]}