CVE-2026-110223

Executive Summary

CVE-2026-110223 is a server-side request forgery (SSRF) vulnerability in Kavita, a self-hosted digital library and reading server, affecting versions 0.9.0 through 0.9.1.4. An authenticated user can submit a URL to the POST /api/Cbl/upload-cbl-file endpoint whose host either rebinds via DNS or redirects over HTTPS to an internal address after the initial validation step, bypassing the SSRF blocklist. The impact is limited to blind internal port and service probing (low confidentiality impact, no integrity or availability impact), reflected in the low CVSS base score of 3.1.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery). Kavita exposes an API endpoint, POST /api/Cbl/upload-cbl-file, that accepts a user-supplied URL, presumably to retrieve a reading-list/CBL file from a remote location. Before issuing the outbound request, the application performs a validation step intended to block requests to internal or private network addresses (an SSRF blocklist / allowlist check).

The core defect is a time-of-check-to-time-of-use (TOCTOU) weakness in that validation. Two mechanisms are explicitly described as bypass vectors:

1. DNS rebinding — The hostname is resolved and validated once during the blocklist check. If the attacker controls the DNS record, the name can resolve to a permitted (public) address during validation and then re-resolve to an internal address (e.g., loopback or RFC1918 space) when the application actually performs the outbound request. Because validation and request issuance use separate DNS resolutions, the blocklist is evaluated against a different address than the one ultimately connected to.

2. HTTPS redirects — The attacker-supplied URL points to an attacker-controlled HTTPS server that passes validation (public address). When the server fetches it, the attacker's server responds with an HTTP redirect (e.g., 302) to an internal address. If the HTTP client follows redirects without re-applying the SSRF blocklist to each hop, the request is re-issued against the internal target.

The result is that only one validation pass is enforced (or redirect targets are not re-validated), so the outbound request can be steered to internal services. No public PoC or Nuclei template exists; the mechanism described here derives directly from the NVD description. The CVSS vector indicates the attack is network-reachable (AV:N), requires high complexity (AC:H — consistent with DNS rebinding/redirect choreography), requires low privileges (PR:L — an authenticated account), needs no user interaction (UI:N), and yields only low confidentiality impact (C:L) with no integrity (I:N) or availability (A:N) impact. The blind nature ("blind internal port and service probing") means the attacker generally infers internal state from timing, error behavior, or response differences rather than reading full response bodies.

Exploitation Scenarios

No public proof-of-concept is available; the following chain is inferred from the described vulnerability class and the explicit details in the NVD description. Only the endpoint and mechanisms named in the description are used.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-reachable Kavita instance running version 0.9.0 through 0.9.1.4, and obtains valid low-privileged credentials (the vulnerability requires an authenticated session, PR:L). The attacker also controls a public hostname (for DNS rebinding) or a public HTTPS server (for redirect-based bypass).

2. Triggering the flaw class. Using the authenticated session, the attacker submits a URL to POST /api/Cbl/upload-cbl-file. In the DNS rebinding variant, the supplied hostname first resolves to the attacker's public address, satisfying the SSRF blocklist check, then is re-resolved to an internal address (e.g., a loopback or private-range service) at request time. In the HTTPS redirect variant, the supplied URL points to an attacker-controlled HTTPS endpoint that returns a redirect to an internal address; if the client follows the redirect without re-validating the destination, the internal request is issued.

3. Payload / execution at the vulnerability-class level. There is no memory-corruption or code-execution payload. The "payload" is the crafted URL and the associated DNS/redirect infrastructure. The server's own HTTP client performs the outbound request to the attacker-selected internal host and port.

4. Post-exploitation impact. Because the description characterizes the outcome as blind internal port and service probing, the attacker uses differential responses — connection success/failure, timing delays, or error messages — to enumerate reachable internal ports and services. This yields internal network reconnaissance only; per the CVSS subscores there is no integrity or availability impact and confidentiality impact is limited to the low-bandwidth, blind signal extracted from the probe. The probe can nonetheless map an internal attack surface for follow-on activity.

Impact Assessment

The vulnerability affects self-hosted Kavita deployments (versions 0.9.0–0.9.1.4) that are reachable by an authenticated user. Business impact is primarily information disclosure through internal reconnaissance: the SSRF lets an authenticated attacker use the Kavita server as a pivot to probe internal-only ports and services from the server's network position. This is valuable for mapping segmented networks and identifying reachable internal services that are not directly exposed to the attacker.

Blast radius considerations: the affected component is the Kavita server itself, and the pivot originates from its network context, so internal services on the same segment or reachable from it are exposed to probing even if they are not internet-facing. However, the CVSS vector (C:L / I:N / A:N, AC:H, PR:L) indicates constrained impact — low confidentiality only, no integrity or availability effects, high attack complexity, and a prerequisite authenticated account. EPSS is 0.00279 (18.9th percentile), and there is no CISA KEV listing, no public PoC, and no Nuclei template, indicating low current exploitation likelihood. There is no tracked patch (0/4 confidence), so the exposure persists until the vendor or operators act.

Detection Guidance

Sigma Rule

title: Potential SSRF via Kavita CBL File Upload Endpoint
id: 9f3c1a2e-7b64-4d21-9a10-0c2b5e6f7a88
status: experimental
description: Detects requests to the Kavita CBL upload endpoint that may abuse DNS rebinding or redirects to reach internal addresses (CVE-2026-110223).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110223
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/Cbl/upload-cbl-file'
  selection_method:
    cs-method: 'POST'
  condition: selection_endpoint and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
  - cs-uri-query
falsepositives:
  - Legitimate users importing CBL reading lists from external sources
level: low

YARA Rule

rule CVE_2026_110223_Kavita_SSRF_CBL_Upload
{
    meta:
        description = "Detects references to the Kavita CBL upload endpoint abused for SSRF (CVE-2026-110223)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110223"
        date = "2026-01-01"
    strings:
        $ep = "/api/Cbl/upload-cbl-file" ascii wide nocase
        $cbl = "upload-cbl-file" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110223 Kavita SSRF Attempt via CBL Upload Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/Cbl/upload-cbl-file"; nocase; classtype:attempted-recon; reference:cve,2026-110223; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110223; sid:2026110223; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=1m
  [ network where http.request.method == "POST" and url.path == "/api/Cbl/upload-cbl-file" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/api/Cbl/upload-cbl-file" method=POST
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,cve-2026-110223,">
  <rule id="2026111" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/Cbl/upload-cbl-file</url>
    <method>POST</method>
    <description>CVE-2026-110223: POST to Kavita CBL upload endpoint - potential SSRF attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workarounds, or affected-version advisory are available from tracked sources.

1. Immediate mitigations

   • Restrict who can authenticate to the Kavita instance; the flaw requires a low-privileged authenticated account (PR:L). Disable or tightly control user registration and access.
   • Place the Kavita server in a segmented network zone so that even a successful SSRF pivot reaches only a minimal set of internal services.
   • Block or monitor outbound traffic originating from the Kavita host to internal/private ranges at the network layer where feasible, and alert on the server initiating connections to unexpected internal hosts or ports.
   • If the CBL upload feature is not required, consider restricting access to POST /api/Cbl/upload-cbl-file at a reverse proxy or WAF (note: this is a compensating control, not a vendor-provided fix).

2. Patch / upgrade steps

   • No patch is currently available per tracked sources. Monitor the Kavita project's release notes and advisory channels for a fixed version covering the range 0.9.0 through 0.9.1.4.
   • Once a fix is released, upgrade immediately and verify that the fix re-validates resolved addresses at request time and re-applies the SSRF blocklist to every redirect hop.

3. Long-term hardening

   • Enforce outbound egress filtering from application servers so internal-only services are unreachable even if a request is forged.
   • Adopt SSRF-safe fetching patterns: resolve-then-pin the validated IP, re-validate redirect destinations, and disallow requests to loopback and private ranges after every resolution.
   • Deploy the detection rules above to flag anomalous use of the affected endpoint and unexpected internal connection attempts.

References

• NVD — CVE-2026-110223: https://nvd.nist.gov/vuln/detail/CVE-2026-110223
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Kavita project (source and release notes): https://github.com/Kareadita/Kavita
• CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE as of data retrieval): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, exploit code, or known in-the-wild campaign activity is associated with CVE-2026-110223 per available data.