Description
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Published: 2026-10-02
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized internal network access and sensitive data exposure
Action: Apply Patch
AI Analysis

Impact

UTMStack versions prior to 11.2.16 contain a server‑side request forgery flaw that allows authenticated users to supply an arbitrary URL to the PdfService.downloadPdf() endpoint (/api/generate-pdf-report). The service then retrieves the target and renders the response into a PDF, potentially exposing confidential internal data. This weakness is classified as CWE‑918.

Affected Systems

The vulnerability affects the UTMStack product for all deployments running a version earlier than 11.2.16. No specific operating system or environment restrictions are listed.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is unclear. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated and can trigger the exploit by sending a crafted GET request containing the target URL; the internal resource can be any internal endpoint, the OpenSearch cluster, or cloud instance‑metadata service.

Generated by OpenCVE AI on October 2, 2026 at 21:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade UTMStack to version 11.2.16 or later to resolve the SSRF issue.
  • If an upgrade is not immediately possible, restrict or remove the /api/generate-pdf-report endpoint from public access or implement input filtering to block URLs that target internal network resources.
  • Deploy network segmentation or firewall rules to limit the web server’s ability to reach internal services such as OpenSearch or metadata endpoints.

Generated by OpenCVE AI on October 2, 2026 at 21:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Utmstack
Utmstack utmstack
Vendors & Products Utmstack
Utmstack utmstack

Fri, 02 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.
Title UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Utmstack Utmstack
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-05T17:13:42.524Z

Reserved: 2026-08-27T21:39:20.461Z

Link: CVE-2026-82044

cve-icon Vulnrichment

Updated: 2026-10-05T17:12:41.545Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T21:16:56.933

Modified: 2026-10-06T15:25:00.650

Link: CVE-2026-82044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:52:56Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)