CVE-2026-122008 | Oqtane Framework up to 10.2.x UploadFile endpoint FileController.cs HttpClient.GetStreamAsync url server-side request forgery

A vulnerability categorized as critical has been discovered in Oqtane Framework up to 10.2.x. The affected element is the function HttpClient.GetStreamAsync of the file FileController.cs of the component UploadFile endpoint. Such manipulation of the argument url leads to server-side request forgery.

This vulnerability is documented as CVE-2026-122008. The attack can be executed remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More