Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-72587

Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TuranSec

Description

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CoreBunch Instatic

Default version status: unknown

  • 0 to ≤ 0.0.14affected

References