High severity · published Apr 22, 2026
CVE-2026-41170
Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
7.2
CVSS
0.2%
EPSS
No
On KEV
Description
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" `HttpClient` without any SSRF protection. A malicious or compromised admin can use this endpoint to probe internal network services, access cloud metadata endpoints, or perform internal reconnaissance. The vulnerability is authenticated (Admin-only) but highly impactful, allowing potential access to sensitive internal resources. Version 7.23.0 contains a fix.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
squidex · Squidex
< 7.23.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41170
github.com
https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4
github.com
https://github.com/Squidex/squidex/security/advisories/GHSA-6q6m-7h5j-jq4g
More from squidex
8.8
CVE-2026-24736
Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration
7.3
CVE-2026-41172
Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
7.3
CVE-2026-41171
SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient
5.5
CVE-2026-41177
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction