Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
CVE-2026-112237
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112237
Extension "Kitodo.Presentation"
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TYPO3",
"product": "Extension \"Kitodo.Presentation\"",
"versions": [
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "6.0.1",
"versionType": "semver"
}
],
"packageName": "kitodo/presentation",
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-112237
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #42524 · Revision 1
- Added to Heist Feed
- Publisher date