PatchTheCVECVE-2026-18359: Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 a
37
Routine
HIGH 8.5UPGRADE
CVE-2026-18359 is a high-severity flaw (CVSS 8.5) affecting escriptorium. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is ap
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 72%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-08-06 |
| Last modified | 2026-10-23 |
Publisher (CNA): GitLab Inc. · Vendor: escriptorium
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
escriptorium escriptorium UPGRADE
Affected: <= 26.04.1
Fixed in: newer than 26.04.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy escriptorium || rpm -q escriptorium || escriptorium --version
2. UPGRADE to newer than 26.04.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade escriptorium
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade escriptorium
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-18258 HIGH 8.8 UPGRADE Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip
- CVE-2026-18277 HIGH 7.1 UPGRADE Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 all
- CVE-2026-18275 MEDIUM 6.5 UPGRADE Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.
- CVE-2026-18276 MEDIUM 4.3 UPGRADE Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authen