Security Advisory

CVE-2026-100391

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-25 20:13:12

Last updated 2026-10-05 14:55:05

Assigner VulnCheck

CVSS score 8.8

State PUBLISHED

Description

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

← Browse all CVEs View on cve.org ↗