TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery
Summary
| CVE | CVE-2026-112358 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-19 22:17:06 UTC |
| Updated | 2026-10-19 22:17:06 UTC |
| Description | A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: "[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release." |
Risk And Classification
Primary CVSS: v4.0 2.1 LOW from [email protected]
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-918 | CWE-918 Server-Side Request Forgery
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 2.1 | LOW | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 2.1 | LOW | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| 3.1 | [email protected] | Primary | 4.1 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L |
| 3.1 | CNA | DECLARED | 4.1 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C |
| 3.0 | CNA | DECLARED | 4.1 | MEDIUM | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C |
| 2.0 | [email protected] | Secondary | 4.3 | AV:N/AC:H/Au:M/C:P/I:P/A:P | |
| 2.0 | CNA | DECLARED | 4.3 | AV:N/AC:H/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:C |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighAttack Requirements
NonePrivileges Required
HighUser Interaction
NoneConfidentiality
LowIntegrity
LowAvailability
LowSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
HighUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/cve/CVE-2026-112358 | [email protected] | vuldb.com | |
| vuldb.com/submit/986821 | [email protected] | vuldb.com | |
| vuldb.com/vuln/422393 | [email protected] | vuldb.com | |
| vuldb.com/vuln/422393/cti | [email protected] | vuldb.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Plus0ne_27 (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-19T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-10-19T02:00:00.000Z | VulDB entry created |
| CNA | 2026-10-19T16:50:29.000Z | VulDB entry last update |
There are currently no legacy QID mappings associated with this CVE.