CVE-2026-101300 Wegow Technologies CVE debrief

Who should care

Defenders responsible for Wegow's deployment and configuration should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and implement compensating controls.

Why it matters

CVE-2026-101300 is a Server-Side Request Forgery (SSRF) vulnerability in Wegow's PDF export functionality. An authenticated user can manipulate requests to external resources, potentially leading to SSRF attacks or embedding of attacker-controlled content. Defenders should prioritize verifying affected versions, assessing exposure, and implementing compensating controls.

• Potential SSRF attacks against external resources
• Possible embedding of attacker-controlled content in generated PDFs
• Risk of unauthorized requests to internal or external resources
• Need for verification of affected versions and configurations

Technical summary

The vulnerability is caused by the manipulation of the <svg> parameter in the POST request generated by selecting Download PDF in Wegow's ticket sales chart PDF export functionality. This allows an authenticated user with a promoter account to send HTTP requests to attacker-controlled external resources, which are then embedded in the generated PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF.

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of Wegow, assessing exposure, and implementing compensating controls to prevent exploitation.

Recommended defensive actions

• Verify the affected versions and configurations of Wegow
• Assess exposure and implement compensating controls
• Monitor for suspicious activity related to the PDF export functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows an authenticated user to manipulate the <svg> parameter, which is processed by the export.highcharts.com service, potentially leading to SSRF attacks. The source report indicates that an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. Defenders should verify affected versions, assess exposure, and prioritize remediation efforts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.