Description
SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can supply arbitrary URLs including internal network addresses and loopback addresses to cause the server to issue HTTP requests to attacker-controlled destinations, enabling internal network enumeration and access to services not intended to be externally reachable.
INFO
Published Date :
2026-04-23T13:45:07.359Z
Last Modified :
2026-04-23T15:35:00.779Z
Source :
VulnCheck
AFFECTED PRODUCTS
The following products are affected by CVE-2026-41461 vulnerability.
No data.
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-41461.
