---
id: CVE-2026-112991
title: >-
  MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in
  is_safe_url()
summary: >-
  The html_to_markdown expansion module in MISP Modules contains a server-side
  request forgery (SSRF) vulnerability in its is_safe_url() URL validation
  function. The BLOCKED_RANGES list used to reject unsafe destination addresses
  was incom…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-918
  - CWE-20
vendor: MISP
product: MISP Modules
affected:
  - modules <= 3.0.12
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T22:19:50.011Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112991'
references:
  - url: >-
      https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b
    label: Security patch
tags:
  - cve.org
ingestedAt: '2026-10-19T22:46:42.319Z'
---

## Overview

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).

An authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server's network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.

The security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.

## Affected

- `modules <= 3.0.12`

## Remediation

The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.