PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-71250 firefly-iii CVE debrief

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back. To address this vulnerability, defenders should review webhook configurations for potential loopback targets, verify webhook URL validation logic, monitor for suspicious webhook activity, restrict webhook access to trusted users, perform exposure reviews for affected systems, check relevant monitoring and logs for exposed assets, and track exceptions and retest remediated assets. The CVE record was published on 2026-08-05T11:16:28.110Z and has not been modified since then. Evidence is limited to the CVE record and NVD detail page. Defenders should verify webhook configurations, monitor for suspicious activity, and review the validator logic.

Vendor
firefly-iii
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-26
Advisory published
2026-08-05
Advisory updated
2026-08-26

Who should care

Users of Firefly III with webhooks enabled, security teams monitoring for SSRF attacks, and operators responsible for webhook configurations and server security should be aware of this vulnerability. They should review webhook configurations, verify validator logic, and monitor for suspicious activity to mitigate potential risks.

Technical summary

The webhook URL validator in Firefly III allows loopback addresses due to an explicit early-return for 127.0.0.0/8 and has a DNS-rebinding vulnerability. This issue permits an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server, potentially leading to blind SSRF attacks. The validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request re-resolves the hostname independently at send time.

Defensive priority

Authenticated users with webhooks enabled could target loopback services, permitting potential blind SSRF attacks.

Recommended defensive actions

  • Review webhook configurations for potential loopback targets
  • Verify webhook URL validation logic
  • Monitor for suspicious webhook activity
  • Restrict webhook access to trusted users
  • Perform exposure review for affected systems
  • Check relevant monitoring and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The CVE description notes that Firefly III's webhook URL validator allows loopback addresses and has a DNS-rebinding vulnerability. This issue permits an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server, potentially leading to blind SSRF attacks. Evidence is limited to the CVE record and NVD detail page. Defenders should verify webhook configurations, monitor for suspicious activity, and review the validator logic.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-71250 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-71250

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-71250 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-71250

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/firefly-iii/firefly-iii

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.