CVE-2026-111663

HIGH 8.6

Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation

CVSS Score

8.6

EPSS Score

0.0%

EPSS Percentile

0th

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

CWE	CWE-918
Vendor	chaskiq
Product	chaskiq
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for chaskiq chaskiq

Be the first to know when new high vulnerabilities affecting chaskiq chaskiq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

chaskiq / chaskiq

0 ≤ 2.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload github.com: https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb#L29-L66 github.com: https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb#L3-L33 vulncheck.com: https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation

Credits

hieuPenguinnn