CVE-2026-91750
mediumWeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from…
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Tencent/WeKnora disclosure@vulncheck.com
- https://github.com/Tencent/WeKnora/blob/v0.6.2/internal/application/service/knowledge_util... disclosure@vulncheck.com
- https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328 disclosure@vulncheck.com
- https://github.com/Tencent/WeKnora/issues/2511 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/weknora-before-0.7.0-ssrf-via-unvalidated-http-redire... disclosure@vulncheck.com
- https://github.com/Tencent/WeKnora/issues/2511 134c704f-9b21-4f2e-91b3-4a467353bcc0