CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
CriticalCVSS 9.2
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Chaskiq | <= 2.0.3 | No fix listed |
References
- hackmd.io exploit third-party-advisory
- github.com technical-description
- github.com technical-description
- VulnCheck Advisory: Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation third-party-advisory