fr0tt CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM fr0tt CVE published 2026-10-26

CVE-2026-116224

A vulnerability was found in fr0tt benotes up to 2.8.1 in the Bookmark Metadata Endpoint of the PostController.php file. The getUrlInfo function is susceptible to server-side request forgery (SSRF) attacks when manipulating the url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. However, the project has not yet responded to the issue report.