CVE-2026-7065

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7065", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T07:12:55.144Z", "datePublished": "2026-04-26T23:00:16.663Z", "dateUpdated": "2026-04-27T12:41:39.168Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T23:00:16.663Z"}, "title": "BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "BidingCC", "product": "BuildingAI", "versions": [{"version": "26.0.0", "status": "affected"}, {"version": "26.0.1", "status": "affected"}], "modules": ["Remote Upload API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/services/file-storage.service.ts of the component Remote Upload API. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T09:18:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MidA (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359640", "name": "VDB-359640 | BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359640/cti", "name": "VDB-359640 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798621", "name": "Submit #798621 | BidingCC BuildingAI 26.0.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/BidingCC/BuildingAI/issues/110", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/BidingCC/BuildingAI/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:41:27.198629Z", "id": "CVE-2026-7065", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:41:39.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7065", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:41:27.198629Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:41:34.651Z"}}], "cna": {"title": "BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "MidA (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "BidingCC", "modules": ["Remote Upload API"], "product": "BuildingAI", "versions": [{"status": "affected", "version": "26.0.0"}, {"status": "affected", "version": "26.0.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T09:18:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359640", "name": "VDB-359640 | BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359640/cti", "name": "VDB-359640 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/798621", "name": "Submit #798621 | BidingCC BuildingAI 26.0.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/BidingCC/BuildingAI/issues/110", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/BidingCC/BuildingAI/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/services/file-storage.service.ts of the component Remote Upload API. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-26T23:00:16.663Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7065", "state": "PUBLISHED", "dateUpdated": "2026-04-27T12:41:39.168Z", "dateReserved": "2026-04-26T07:12:55.144Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-26T23:00:16.663Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Remote Upload API"], "product": "BuildingAI", "vendor": "BidingCC", "versions": [{"status": "affected", "version": "26.0.0"}, {"status": "affected", "version": "26.0.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/services/file-storage.service.ts of the component Remote Upload API. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en BidingCC BuildingAI hasta la versi\u00f3n 26.0.1. La funci\u00f3n afectada es uploadRemoteFile del archivo packages/core/src/modules/upload/services/file-storage.service.ts del componente API de Carga Remota. La manipulaci\u00f3n del argumento url conduce a una falsificaci\u00f3n de petici\u00f3n del lado del servidor. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-7065", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7065", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:41:27.198629Z", "version": "2.0.3"}}]}, "published": "2026-04-27T00:16:20.523", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/BidingCC/BuildingAI/"}, {"source": "cna@vuldb.com", "url": "https://github.com/BidingCC/BuildingAI/issues/110"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/798621"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359640"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359640/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "26.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BuildingAI", "source": "cna", "vendor": "BidingCC"}, "product": "buildingai", "vendor": "bidingcc"}], "analysis": {"en": {"generated_at": "2026-04-28T05:02:11.381436+00:00", "value": {"mitigation_remediation": ["Upgrade BidingCC BuildingAI to a version newer than 26.0.1 once the vendor releases a fix.", "Implement network segmentation or firewall rules that block outbound traffic from the application server to internal or untrusted destinations, reducing the impact of SSRF.", "Add strict validation or an allow\u2011list for the url parameter in the uploadRemoteFile API to reject or whitelist acceptable targets."], "summary": {"action": "Assess Impact", "impact": "Server\u2011side request forgery"}, "threat_synthesis": {"affected_systems": "BidingCC BuildingAI versions up to and including 26.0.1 are affected. The flaw is located in the file-storage.service.ts module under packages/core/src/modules/upload/services. No newer versions are documented as safe.", "description_and_impact": "The vulnerability resides in the uploadRemoteFile function within the Remote Upload API. A malformed or crafted argument for the url parameter allows an attacker to instruct the application server to make arbitrary HTTP requests. This SSRF capability can expose internal services, read sensitive data, or pivot to other systems, thereby compromising confidentiality and integrity. The description does not indicate denial\u2011of\u2011service impacts.", "risk_and_exploitability": "The CVSS base score is 6.9, reflecting moderate to high risk. The EPSS score of <1% suggests a low probability of current exploitation, and the issue is not in the CISA KEV catalog. The exploitation is remote and does not require local access; an attacker only needs to cause the application to request an arbitrary URL. No official patch or workaround has been released yet."}}}}, "created": "2026-04-27T19:51:50.301834+00:00", "updated": "2026-04-28T05:15:22.934169+00:00", "vendors": ["bidingcc", "bidingcc$PRODUCT$buildingai"]}