Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-11437 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-11437

CVE-2026-11437

HIGH7.3

perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

Published Jun 6, 2026

Modified 2 weeks ago

Details

A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://vuldb.com/cve/CVE-2026-11437

https://vuldb.com/submit/822726

https://vuldb.com/vuln/369017

https://vuldb.com/vuln/369017/cti

https://www.cve.org/CVERecord?id=CVE-2026-11437

https://www.notion.so/Server-Side-Request-Forgery-SSRF-in-go-fastdfs-web-Installation-Endpoint-35aea92a3c41806485ffeeac7e18126a

CVSS Analysis

CVSS v4.0

6.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

LowVC:L

Vuln. Integrity

LowVI:L

Vuln. Availability

LowVA:L

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.9/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Weakness Type (CWE)

Input Validation

Server-Side Request Forgery (SSRF)

Ecosystems

Timeline

PublishedJun 6, 2026

ModifiedJun 8, 2026