Low severity · published Oct 13, 2026
CVE-2026-110223
Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Kavita · Kareadita
0.9.0 through 0.9.1.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110223
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110223
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kavita-cbl-url-preflight-ssrf
technical-description
https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f88dde8eb874cc99a3397eb11/Kavita.Server/Controllers/CBLController.cs#L82-L108
technical-description
https://github.com/Kareadita/Kavita/blob/879b8b73eb41d66f88dde8eb874cc99a3397eb11/Kavita.Common/Helpers/FlurlConfiguration.cs#L46-L89
product
https://github.com/Kareadita/Kavita
third-party-advisory
https://www.vulncheck.com/advisories/kavita-0.9.0-through-0.9.1.4-ssrf-blocklist-bypass-via-upload-cbl-file-endpoint
More from Kavita
9.3
CVE-2026-47202
Kavita: Pre-Auth Account Takeover
7.5
CVE-2022-51024
Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
6.9
CVE-2026-44775
Kavita: No authentication at /api/Reader/image
5.9
CVE-2026-44776
Kavita: IDOR in /api/Download/*