PatchSiren

lhccong CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM lhccong CVE published 2026-10-16

CVE-2026-111720

CVE-2026-111720 is a server-side request forgery vulnerability in fish-island-backend through commit 7c61b78. This vulnerability allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Defenders should verify exposure of the /api/web/parse endpoint and ensure that th [truncated]