CVE-2026-52840: Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
Caldav::connect_to_server at application/controllers/Caldav.php:60 hands the request’s caldav_url to a Guzzle REPORT call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment’s network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON message field (Caldav.php:74-78), so the SSRF is semi-blind.
References
- github.com/advisories/GHSA-pm5p-7w5h-jm5q
- github.com/alextselegidis/easyappointments/commit/2da2baed18ec32ad7916e507815709c8f010d510
- github.com/alextselegidis/easyappointments/commit/4abb10545d83ac1a57d03f6502376ee67696ea7c
- github.com/alextselegidis/easyappointments/commit/6b34b78c47790dfd1dec27cf62926db51be276e9
- github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536
- github.com/alextselegidis/easyappointments/releases/tag/1.6.0
- github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q
- nvd.nist.gov/vuln/detail/CVE-2026-52840
Code Behaviors & Features
Detect and mitigate CVE-2026-52840 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →