Description

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

Related CPE's

Could not find any relations

References

https://github.com/kanbn/kan

https://github.com/kanbn/kan/blob/v0.6.0/.env.example#L25-L27

https://github.com/kanbn/kan/blob/v0.6.0/apps/web/src/pages/api/download/attatchment.ts#L21-L52

https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7

https://github.com/kanbn/kan/pull/590

https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg

https://hackmd.io/@leediay/HyIxU63ofg

https://www.vulncheck.com/advisories/kan-0.5.5-through-0.6.0-unauthenticated-ssrf-via-api-download-attatchment

Weaknesses

[email protected]

Primary
CWE-918

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

8.6 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-14T15:17:15.540Z

2 hours ago

Last modified

2026-10-14T15:17:15.653Z

2 hours ago