by Kastro
Paper/Archive/CVE-2026-63306

CVE-2026-63306

stoatchat stoatchat — stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints

EPSS 0.3%public exploitCVSS 9.2
critical.is priorityof 100
42
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 23.3.233 × 204.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

Affected

ProductAffectedFixed inSource
stoatchat< 0.13.50.13.5CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
VulnCheck (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5writeupvulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints