org.apache.fesod vulnerabilities

Products

• org.apache.fesod/fesod-sheet 2

Latest org.apache.fesod CVEs

Newest publication first

1. CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

   Published 2026-10-13

   Critical·CVSS 9.1

   Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter ch...

2. CVE-2026-49328 Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF

   Published 2026-06-01

   Medium·CVSS 5.3

   Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recomm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.