What is CVE-2026-41177?

CVE-2026-41177 is a medium-severity vulnerability in Squidex, classified under External Control of File Name or Path. CVSS score: 5.5/10. Published 2026-04-22.

How severe is CVE-2026-41177?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Is CVE-2026-41177 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Squidex

CVE-2026-41177

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). The application fails to validate the URI…

EPSS: 0.001 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L.

Affected products

Squidex — versions < 7.23.0

Weakness classification (CWE)

Public proof-of-concept exploits

TurkiOS/CVE-2026-41177-Squidex-CMS

References

https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5 (x_refsource_CONFIRM)
https://github.com/Squidex/squidex/commit/b81d75e1d9c1a8e30993c2ee59b350002b9aeda4 (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-41177?: CVE-2026-41177 is a medium-severity vulnerability in Squidex, classified under External Control of File Name or Path. CVSS score: 5.5/10. Published 2026-04-22.
How severe is CVE-2026-41177?: Medium severity. CVSS v3 base score is 5.5 out of 10.
Is CVE-2026-41177 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.