CVE-2026-101300
Server-Side Request Forgery in Wegow PDF export
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
| CWE | CWE-918 |
| Vendor | wegow technologies |
| Product | wegow |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for wegow technologies wegow
Be the first to know when new unknown vulnerabilities affecting wegow technologies wegow are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Wegow Technologies / Wegow
actual version
References
Credits
Cosme Vázquez Tomé