CVE-2026-129485 | Yuzutech Kroki up to 0.35.x BlockDiag Engine /blockdiag/svg background server-side request forgery (EUVD-2026-126082)

November 15, 2026 Yanac

A vulnerability identified as problematic has been detected in Yuzutech Kroki up to 0.35.x. This impacts an unknown function of the file /blockdiag/svg of the component BlockDiag Engine. Performing a manipulation of the argument Background results in server-side request forgery.

This vulnerability was named CVE-2026-129485. The attack may be initiated remotely. There is no available exploit.

You should upgrade the affected component.VulDB Recent EntriesRead More