CVE-2026-108770

5.3Medium

Published 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Remote, unauthenticated attackers can trigger server-side request forgery (SSRF) to read internal network resources. They only need network access to the Browser Screenshot Service endpoint.

Root cause

Improper validation of the url parameter in the PublicHostname function allows arbitrary internal HTTP requests.

Affected systems

Appwrite versions up to and including 2.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade Appwrite to version 2.4.0 or apply commit 393255e7302ae5503331d45802e2eee01c6a47fe. No interim mitigation is documented, so restrict access to the Browser Screenshot endpoint if you cannot patch immediately.

shell

$ docker compose pull && docker compose up -d

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108770