Login Request a demo
High severity · published Sep 5, 2026
CVE-2026-86119
Webstudio through 0.296.0 SSRF via /cgi proxy routes
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
webstudio · webstudio-is
through 0.296.0 · source: vendor
Affected product
WE
webstudio
webstudio-is
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86119
github.com
https://github.com/webstudio-is/webstudio
github.com
https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.asset.$.ts
github.com
https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.image.$.ts
github.com
https://github.com/webstudio-is/webstudio/blob/55920c57c4d3e128a0fa48fceabbbc3a1d73f1ef/apps/builder/app/routes/cgi.video.$.ts
github.com
https://github.com/webstudio-is/webstudio/issues/5816
www.vulncheck.com
https://www.vulncheck.com/advisories/webstudio-through-0.296.0-ssrf-via-cgi-proxy-routes
More from webstudio
3.1
CVE-2026-113596
Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds