HIGH 7.1 NVD

CVE-2026-101300

Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a p

Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/server-side-request-forgery-wegow-pdf-e

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-16 via NVD.

vulnfeed aggregates 16278 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.