Technical impact
The Squidex Restore API accepts a user‑supplied Url parameter without validating its scheme, permitting use of the file:// protocol. An authenticated administrator can force the backend server to access any local file via the Restore API, leading to local file interaction and potential disclosure of sensitive information through side‑channel analysis of internal logs. The flaw does not provide arbitrary code execution.
Affected Systems
All Squidex installations running a version earlier than 7.23.0 are vulnerable. The exploitation requires administrator privileges to the HQ API; only users with such access can invoke the Restore endpoint. Version 7.23.0 and later contain the fix.
Risk and Exploitability
The CVSS base score of 5.5 indicates moderate severity. The EPSS score of < 1% shows a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated administrator access, the risk is limited to environments where such accounts are compromised or misused. No remote, unauthenticated attacker can exploit the flaw.
