{"id":"CVE-2026-112991","title":"MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()","summary":"The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incom…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-918","CWE-20"],"vendor":"MISP","product":"MISP Modules","affected":["modules <= 3.0.12"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T22:19:50.011Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112991","references":[{"url":"https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b","label":"Security patch"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T22:46:42.319Z","slug":"CVE-2026-112991","body":"## Overview\n\nThe html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.\n\n## Affected\n\n- `modules <= 3.0.12`\n\n## Remediation\n\nThe fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}