{"id":"CVE-2026-115752","summary":"Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon","details":"Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.","aliases":["GHSA-7wpf-ch8f-5f4x"],"modified":"2026-10-31T02:30:43.777411269Z","published":"2026-10-23T13:03:34.217Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115752.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115752.json"},{"type":"ADVISORY","url":"https://github.com/SignalK/signalk-server/releases/tag/v2.34.0"},{"type":"ADVISORY","url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7wpf-ch8f-5f4x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115752"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/signal-k-server-2.28.0-beta.2-before-2.34.0-ssrf-via-app-store-appicon"},{"type":"FIX","url":"https://github.com/SignalK/signalk-server/commit/535104f655304c697d535252da397948e5101dc6"},{"type":"PACKAGE","url":"https://github.com/SignalK/signalk-server"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/signalk/signalk-server","events":[{"introduced":"3d802f7856d806d8cdd47a55170b92d3c18dff5d"},{"fixed":"55466a958cf2958542208fed559d70911888f1bb"},{"fixed":"535104f655304c697d535252da397948e5101dc6"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.28.0-beta.2"},{"fixed":"2.34.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"535104f655304c697d535252da397948e5101dc6"}]},{"original_tag":"v2.34.0","range":[{"fixed":"55466a958cf2958542208fed559d70911888f1bb"}],"source":"REFERENCES_TAG"}]}}],"versions":["v2.33.0","v2.32.0","v2.31.1","v2.31.0","v2.31.0-beta.2","v2.31.0-beta.1","v2.30.0","v2.29.0","v2.28.0","v2.28.0-beta.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115752.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}