Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-55190

Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get($url) then the response body is parsed and imported as events, and file_get_contents($ogImage)). At time of publication, there are no publicly available patches.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

eventschedule eventschedule

  • <= 1.0.0affected

References