CVE-2026-19927 - Vulnerability Details

- OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

Description

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.

Published: 2026-08-16

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Upload method of the ProductController, where an attacker can supply a crafted params.url value that causes the server to fetch arbitrary URLs. This provides a server‑side request forgery that allows a remote attacker to make the application send requests to internal or external hosts, potentially exfiltrating data or interacting with services that are otherwise inaccessible.

Affected Systems

OpenBoxes versions 0.9.7 and earlier are affected. The vendor, OpenBoxes, released a hot‑fix 0.9.8‑hotfix1 and a standard 0.9.8 release that contain the mitigation. These patches include commit a599007325efe780a21b3537ecce3ca25635c926. Only OpenBoxes products listed in the CPE (openboxes:openboxes) were impacted.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate risk, and the EPSS is not available, but the vulnerability has been publicly disclosed and can be exploited remotely. It is not currently listed in the CISA KEV catalog, yet the public exploit artifacts on GitHub and VULDB indicate that an attacker can achieve SSRF without special privileges. Therefore, the risk remains significant for systems still running the affected versions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

OpenBoxes

affected

Version	Status	Constraints
`0.9.0`	affected	—
`0.9.1`	affected	—
`0.9.2`	affected	—
`0.9.3`	affected	—
`0.9.4`	affected	—
`0.9.5`	affected	—
`0.9.6`	affected	—
`0.9.7`	affected	—
`0.9.8-hotfix1`	unaffected	—
`0.9.8`	unaffected	—

No data.

Vendor Product Confidence Versions

Openboxes

95%

Version	Status	Scheme	Platform
`0.9.0`	affected	semver	—
`0.9.1`	affected	semver	—
`0.9.2`	affected	semver	—
`0.9.3`	affected	semver	—
`0.9.4`	affected	semver	—
`0.9.5`	affected	semver	—
`0.9.6`	affected	semver	—
`0.9.7`	affected	semver	—
`0.9.8-hotfix1`	unaffected	semver	—
`0.9.8`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade OpenBoxes to version 0.9.8‑hotfix1 or later.
Implement input validation or host restrictions on the Product upload endpoint to block arbitrary URLs until a patch is available.
Apply network segmentation or firewall rules to limit outbound requests from the application to trusted hosts.

Generated by OpenCVE AI on August 16, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00251.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c
https://github.com/OpenBoxes/OpenBoxes/
https://github.com/OpenBoxes/OpenBoxes/pull/5944
https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-828r-3vx8-65wx
https://github.com/openboxes/openboxes/commit/a599007325efe780a21b3537ecce3ca25635c926
https://github.com/openboxes/openboxes/releases/tag/v0.9.8
https://vuldb.com/cve/CVE-2026-19927
https://vuldb.com/submit/871980
https://vuldb.com/vuln/390178
https://vuldb.com/vuln/390178/cti

History

Tue, 18 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 16 Aug 2026 02:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.
Title		OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
First Time appeared		Openboxes Openboxes openboxes
Weaknesses		CWE-918
CPEs		cpe:2.3:a:openboxes:openboxes::::::::
Vendors & Products		Openboxes Openboxes openboxes
References		https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c https://github.com/OpenBoxes/OpenBoxes/ https://github.com/OpenBoxes/OpenBoxes/pull/5944 https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-828r-3vx8-65wx https://github.com/openboxes/openboxes/commit/a599007325efe780a21b3537ecce3ca25635c926 https://github.com/openboxes/openboxes/releases/tag/v0.9.8 https://vuldb.com/cve/CVE-2026-19927 https://vuldb.com/submit/871980 https://vuldb.com/vuln/390178 https://vuldb.com/vuln/390178/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Openboxes Openboxes

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-08-16T02:00:14.639Z

Updated: 2026-08-17T15:46:14.392Z

Reserved: 2026-08-15T05:46:46.432Z

Link: CVE-2026-19927

Vulnrichment

Updated: 2026-08-17T15:46:10.312Z

NVD

Status : Deferred

Published: 2026-08-16T03:16:49.333

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-19927

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-16T10:45:16Z

Weaknesses

CWE-918
Server-Side Request Forgery (SSRF)

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object