What is GHSA-vqc2-c9jh-3jjv?

GHSA-vqc2-c9jh-3jjv is a security advisory published by GitHub Security Advisories with Medium severity. Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

Which CVE IDs does GHSA-vqc2-c9jh-3jjv cover?

GHSA-vqc2-c9jh-3jjv covers the following CVE IDs: CVE-2026-49328. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vqc2-c9jh-3jjv?

GHSA-vqc2-c9jh-3jjv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-vqc2-c9jh-3jjv?

GHSA-vqc2-c9jh-3jjv affects 1 product, including: maven/org.apache.fesod:fesod-sheet:\u003c 2.0.2-incubating.

GHSA-vqc2-c9jh-3jjvMediumCVSS 5.3

Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

Vendor

GitHub Security Advisories

Published

June 1, 2026

Last Modified

July 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-49328 →

📋 Description

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

🎯 Affected products1

maven/org.apache.fesod:fesod-sheet:< 2.0.2-incubating

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2026-49328
https://github.com/apache/fesod/pull/917
https://fesod.apache.org/docs/download
https://github.com/apache/fesod/releases/tag/2.0.2-incubating
https://lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj
http://www.openwall.com/lists/oss-security/2026/06/01/4
https://github.com/advisories/GHSA-vqc2-c9jh-3jjv