Medium severity · published May 23, 2026
CVE-2026-9304
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
5.0
CVSS
0.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cal.diy · calcom
4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9304
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9304
gist.github.com
https://gist.github.com/YLChen-007/b3d0b85767b7e346a291933d602fbb3b
vuldb.com
https://vuldb.com/submit/812176
vuldb.com
https://vuldb.com/vuln/365251
vuldb.com
https://vuldb.com/vuln/365251/cti
More from cal.diy
10.0
CVE-2025-71389
Cal.com before 5.9.9 Remote Code Execution via RSC
9.9
CVE-2024-58354
cal.com Repository Takeover via pull_request_target Workflow
8.9
CVE-2024-58355
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
8.9
CVE-2024-58353
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
6.3
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization