CVE-2026-49328: Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component

June 1, 2026 (updated July 8, 2026)

Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to version 2.0.2-incubating, which fixes this issue.

References

fesod.apache.org/docs/download
github.com/advisories/GHSA-vqc2-c9jh-3jjv
github.com/apache/fesod/pull/917
github.com/apache/fesod/releases/tag/2.0.2-incubating
lists.apache.org/thread/c1pb5b66h02p9tlrnfbwcgcz85v16fkj
nvd.nist.gov/vuln/detail/CVE-2026-49328

Code Behaviors & Features

Detect and mitigate CVE-2026-49328 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →