CVE-2026-108521 | Studio-Saelix Sencho up to 0.97.1 Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability categorized as problematic has been discovered in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery.

This vulnerability is documented as CVE-2026-108521. The attack can be executed remotely. Additionally, an exploit exists.

The vendor confirms: “The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.”VulDB Recent EntriesRead More