PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-71250 firefly-iii CVE debrief

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back. To address this vulnerability, defenders should review webhook configurations for potential loopback targets, verify webhook URL validation logic, monitor for suspicious webhook activity, restrict webhook access to trusted users, perform exposure reviews for affected systems, check relevant monitoring and logs for exposed assets, and track exceptions and retest remediated assets. The CVE record was published on 2026-08-05T11:16:28.110Z and has not been modified since then. Evidence is limited to the CVE record and NVD detail page. Defenders should verify webhook configurations, monitor for suspicious activity, and review the validator logic.

Vendor
firefly-iii
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-05
Advisory published
2026-08-05
Advisory updated
2026-08-05

Who should care

Users of Firefly III with webhooks enabled, security teams monitoring for SSRF attacks, and operators responsible for webhook configurations and server security should be aware of this vulnerability. They should review webhook configurations, verify validator logic, and monitor for suspicious activity to mitigate potential risks.

Technical summary

The webhook URL validator in Firefly III allows loopback addresses due to an explicit early-return for 127.0.0.0/8 and has a DNS-rebinding vulnerability. This issue permits an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server, potentially leading to blind SSRF attacks. The validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request re-resolves the hostname independently at send time.

Defensive priority

Authenticated users with webhooks enabled could target loopback services, permitting potential blind SSRF attacks.

Recommended defensive actions

  • Review webhook configurations for potential loopback targets
  • Verify webhook URL validation logic
  • Monitor for suspicious webhook activity
  • Restrict webhook access to trusted users
  • Perform exposure review for affected systems
  • Check relevant monitoring and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The CVE description notes that Firefly III's webhook URL validator allows loopback addresses and has a DNS-rebinding vulnerability. This issue permits an authenticated user with webhooks enabled to configure a webhook targeting loopback services on the server, potentially leading to blind SSRF attacks. Evidence is limited to the CVE record and NVD detail page. Defenders should verify webhook configurations, monitor for suspicious activity, and review the validator logic.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-05T11:16:28.110Z and has not been modified since then.