CVE-2026-9304

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9304", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-22T17:54:42.546Z", "datePublished": "2026-05-23T13:45:08.165Z", "dateUpdated": "2026-05-26T13:57:25.677Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-23T13:45:08.165Z"}, "title": "calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "calcom", "product": "cal.diy", "versions": [{"version": "4.9.0", "status": "affected"}, {"version": "4.9.1", "status": "affected"}, {"version": "4.9.2", "status": "affected"}, {"version": "4.9.3", "status": "affected"}, {"version": "4.9.4", "status": "affected"}], "cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "modules": ["Logo API"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.6, "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-22T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-22T20:00:01.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-z (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/365251", "name": "VDB-365251 | calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365251/cti", "name": "VDB-365251 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/812176", "name": "Submit #812176 | cal.com <= v4.9.4 Server-Side Request Forgery (CWE-918)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/b3d0b85767b7e346a291933d602fbb3b", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T13:57:15.324229Z", "id": "CVE-2026-9304", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T13:57:25.677Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9304", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T13:57:15.324229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T13:57:20.846Z"}}], "cna": {"title": "calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-z (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.6, "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "vendor": "calcom", "modules": ["Logo API"], "product": "cal.diy", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}]}], "timeline": [{"lang": "en", "time": "2026-05-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-22T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-22T20:00:01.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/365251", "name": "VDB-365251 | calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365251/cti", "name": "VDB-365251 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/812176", "name": "Submit #812176 | cal.com <= v4.9.4 Server-Side Request Forgery (CWE-918)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/b3d0b85767b7e346a291933d602fbb3b", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-23T13:45:08.165Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9304", "state": "PUBLISHED", "dateUpdated": "2026-05-26T13:57:25.677Z", "dateReserved": "2026-05-22T17:54:42.546Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-23T13:45:08.165Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "modules": ["Logo API"], "product": "cal.diy", "vendor": "calcom", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de seguridad en calcom cal.diy hasta la versi\u00f3n 4.9.4. El elemento afectado es la funci\u00f3n validateUrlForSSRF del archivo apps/web/app/api/logo/route.ts del componente Logo API. La manipulaci\u00f3n resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. Es posible lanzar el ataque de forma remota. Los ataques de esta naturaleza son altamente complejos. La explotabilidad se describe como dif\u00edcil. El exploit ha sido publicado y puede ser utilizado para ataques. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-9304", "lastModified": "2026-07-23T11:10:00.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9304", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T13:57:15.324229Z", "version": "2.0.3"}}]}, "published": "2026-05-23T14:16:44.080", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/b3d0b85767b7e346a291933d602fbb3b"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/812176"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365251"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365251/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cal.diy", "source": "cna", "vendor": "calcom"}, "product": "cal.diy", "vendor": "calcom"}], "created": "2026-05-23T15:30:20.930948+00:00", "updated": "2026-05-25T11:33:36.988893+00:00", "vendors": ["calcom", "calcom$PRODUCT$cal.diy"]}