CVE-2026-42141 - Vulnerability Analysis

Overview

Xibo CMS < 4.4.1 contains an authenticated server-side request forgery caused by improper validation of Library upload permissions, letting authenticated users make arbitrary HTTP requests from the server, exploit requires authenticated user with Library upload permissions.

Severity & Score

Impact

Authenticated users can make arbitrary HTTP requests from the server, potentially accessing internal services or exfiltrating data.

Mitigation

Update to version 4.4.1 or later.

References

• https://github.com/xibosignage/xibo-cms/security/advisories/GHSA-fwq8-c4gw-pxmh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner