CVE-2026-32255

HIGH EPSS 95.0%
Published Mar 19, 20263mo ago · Modified Jun 17, 20262w ago
8.6 CVSS 3.1
High
Find Similar
Published Mar 19, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

CVSS Details

Base Score
8.6
Exploitability
3.9
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
95.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
kankan* <0.5.5

References 3

  • github.com https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
    Patch
  • github.com https://github.com/kanbn/kan/releases/tag/v0.5.5
    ProductRelease Notes
  • github.com https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7
    Patch
  • github.com https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg
    MitigationPatchVendor Advisory