EUVD-2026-266938

fkie_cve-2026-24767

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation. This allows limited outbound requests to arbitrary URLs before SSRF controls are applied. Version 0.301.0 contains a patch for the issue.

GHSA-xr7v-j379-34v9 — NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

Affected: npm: nocodb

## Summary

A **blind Server-Side Request Forgery (SSRF)** vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.

This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.

---

## Vulnerability Details

The `uploadViaURL()` function issues an `axios.head()` request to retrieve metadata (content type, content length, and final URL after redirects). This request is performed **without SSRF filtering**.

Although the actual file download is protected by request filtering, the initial `HEAD` request occurs prior to these checks and can be triggered with an attacker-controlled URL.

### Vulnerable Code

```ts if (!url.startsWith('data:')) { response = await axios.head(url, { maxRedirects: 5 }); mimeType = response.headers['content-type']?.split(';')[0]; size = response.headers['content-length']; finalUrl = response.request.res.responseUrl; } ```

---

## Impact

The impact of this issue is **limited** due to the following constraints:

* Only `HEAD` requests are affected (no response body is returned) * No direct exfiltration of response data occurs * The subsequent file-fetching logic enforces SSRF protections

However, the vulnerability may still allow:

* **Blind SSRF** via outbound `HEAD` requests * **Limited internal service probing** (reachability and respons…

Most recent entries from all

EUVD-2026-266938

fkie_cve-2026-24767

GHSA-xr7v-j379-34v9 — NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality