CVE-2026-41461
SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can supply arbitrary URLs including internal network addresses and loopback addresses to cause the server to issue HTTP requests to attacker-controlled destinations, enabling internal network enumeration and access to services not intended to be externally reachable.
| CWE | CWE-918 |
| Vendor | socialengine |
| Product | socialengine |
| Published | Apr 23, 2026 |
| Last Updated | Apr 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for socialengine socialengine
Be the first to know when new high vulnerabilities affecting socialengine socialengine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
SocialEngine / SocialEngine
0 ≤ 7.8.0
References
Credits
Egidio Romano