{"id":"CVE-2026-112991","summary":"MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()","details":"The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.","modified":"2026-10-20T11:18:25.289166019Z","published":"2026-10-19T22:19:50.011Z","database_specific":{"cna_assigner":"CIRCL","cwe_ids":["CWE-20","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112991.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112991.json"},{"type":"PACKAGE","url":"https://github.com/misp/misp-modules"},{"type":"FIX","url":"https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112991"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/misp/misp-modules","events":[{"introduced":"0"},{"last_affected":"39215dbfbc98c9fcec3bd858ebebcdbae9acc12c"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"3.0.12"}]}}],"versions":["v3.0.12","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v2.4.172","v2.4.171","v2.4.163","v2.4.162","v2.4.160","v2.4.159","v2.4.157","v2.4.156","v2.4.154","v2.4.153","v2.4.151","v2.4.150","v2.4.148","v2.4.147","v2.4.145","v2.4.144","v2.4.143","v2.4.142","v2.4.141","v2.4.137","v2.4.136","v2.4.134","v2.4.121","v2.4.120","v2.4.119","v2.4.118","v2.4.116","v2.4.113","v2.4.110"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112991.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}]}