CVE-2026-49328: Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

June 1, 2026 (updated July 8, 2026)

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

References

fesod.apache.org/docs/download
github.com/advisories/GHSA-vqc2-c9jh-3jjv
github.com/apache/fesod/pull/917
github.com/apache/fesod/releases/tag/2.0.2-incubating
lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj
nvd.nist.gov/vuln/detail/CVE-2026-49328

Code Behaviors & Features

Detect and mitigate CVE-2026-49328 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →