CVE-2026-7084

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7084", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T08:16:21.874Z", "datePublished": "2026-04-27T03:45:11.797Z", "dateUpdated": "2026-04-27T13:29:56.216Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T03:45:11.797Z"}, "title": "HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "HBAI-Ltd", "product": "Toonflow-app", "versions": [{"version": "1.1.0", "status": "affected"}, {"version": "1.1.1", "status": "affected"}], "modules": ["getCodeByLink Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that \"[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T10:21:34.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359659", "name": "VDB-359659 | HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359659/cti", "name": "VDB-359659 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799582", "name": "Submit #799582 | HBAI-Ltd Toonflow 1.1.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95#issuecomment-4208181221", "tags": ["issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/", "tags": ["product"]}], "tags": ["disputed"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T13:09:33.463138Z", "id": "CVE-2026-7084", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:29:56.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7084", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T13:09:33.463138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T13:09:34.646Z"}}], "cna": {"tags": ["disputed"], "title": "HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "Yu Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"vendor": "HBAI-Ltd", "modules": ["getCodeByLink Endpoint"], "product": "Toonflow-app", "versions": [{"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.1.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T10:21:34.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359659", "name": "VDB-359659 | HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359659/cti", "name": "VDB-359659 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799582", "name": "Submit #799582 | HBAI-Ltd Toonflow 1.1.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95#issuecomment-4208181221", "tags": ["issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that \"[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T03:45:11.797Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7084", "state": "PUBLISHED", "dateUpdated": "2026-04-27T13:29:56.216Z", "dateReserved": "2026-04-26T08:16:21.874Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T03:45:11.797Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["getCodeByLink Endpoint"], "product": "Toonflow-app", "vendor": "HBAI-Ltd", "versions": [{"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.1.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that \"[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it.\""}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en HBAI-Ltd Toonflow-app hasta 1.1.1. Esto afecta la funci\u00f3n fetch del archivo src/routes/setting/vendorConfig/getCodeByLink.ts del componente getCodeByLink Endpoint. La manipulaci\u00f3n del argumento Link resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede realizarse de forma remota. El exploit se ha hecho p\u00fablico y podr\u00eda utilizarse. Existe una duda persistente con respecto a la existencia real de esta vulnerabilidad. El proveedor explica en una respuesta al informe del problema que \u2019La interfaz /getCodeByLink se utiliza para obtener c\u00f3digo TS y ejecutarlo localmente. Es inherentemente una interfaz de alto riesgo, y los usuarios deben comprender claramente los riesgos antes de solicitar su uso.\u2019"}], "id": "CVE-2026-7084", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7084", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T13:09:33.463138Z", "version": "2.0.3"}}]}, "published": "2026-04-27T04:16:09.933", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/"}, {"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95"}, {"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/95#issuecomment-4208181221"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/799582"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359659"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359659/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Toonflow-app", "source": "cna", "vendor": "HBAI-Ltd"}, "product": "toonflow-app", "vendor": "hbai-ltd"}], "analysis": {"en": {"generated_at": "2026-04-28T04:50:35.971388+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch that updates Toonflow\u2011app beyond version 1.1.1", "If a patch is unavailable, disable or tightly restrict the /getCodeByLink endpoint for untrusted users or in production environments", "Implement strict input validation to whitelist permitted domains or enforce HTTPS only for outbound requests"], "summary": {"action": "Patch or Disable", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Toonflow\u2011app from HBAI\u2011Ltd, versions up to and including 1.1.1, are affected.", "description_and_impact": "The getCodeByLink endpoint in HBAI\u2011Ltd Toonflow\u2011app is vulnerable to server\u2011side request forgery when the Link argument is manipulated. A remote attacker can cause the application to fetch an arbitrary URL and trigger actions on the server, potentially exposing internal network resources or enabling data exfiltration. The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The exploit is publicly known and can be triggered from the internet.", "risk_and_exploitability": "The EPSS score of less than 1% suggests a low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is remote and the endpoint is inherently high\u2011risk, the potential impact remains significant if an attacker can reach the service. Exploitation requires only the ability to issue an HTTP request to the /getCodeByLink API with a crafted Link parameter; no privileged access is needed."}}}}, "created": "2026-04-27T19:51:43.901046+00:00", "updated": "2026-04-28T05:00:14.738767+00:00", "vendors": ["hbai-ltd", "hbai-ltd$PRODUCT$toonflow-app"]}