CVE-2026-55372: NukeViet Pre-authentication SSRF via X-Forwarded-Host
Summary
CVE-2026-55372: NukeViet: Pre-authentication SSRF via X-Forwarded-Host. Affects nukeviet/nukeviet versions < 4.6.00. Fixed in 4.6.00. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NukeViet is an open-source content management system (CMS) that allows users to create and manage websites easily. It is designed for flexibility and extensibility, making it suitable for various applications. However, like many web applications, it can be vulnerable to security issues, particularly those related to improper handling of HTTP headers.
Vulnerability Detail
The vulnerability arises from an unauthenticated Server-Side Request Forgery (SSRF) that allows attackers to manipulate the server into making HTTP requests to arbitrary hosts. This is achieved by spoofing the 'X-Forwarded-Host' and 'X-Forwarded-Proto' headers, which are used without proper validation in the 'server_info_update()' function. The attacker can exploit this flaw to discover internal services or poison cached server headers, although the attack is limited to blind, HEAD-only requests with a fixed path, preventing direct data exfiltration.
How To Fix
Minimum fixed version
4.6.00
This is the first release that contains the fix.
composer require nukeviet/nukeviet:4.6.00Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, configure your reverse proxy or web server to strip or override client-supplied 'X-Forwarded-Host', 'X-Forwarded-Proto', and 'X-Forwarded-Port' headers. Additionally, ensure that 'my_domains' is configured with the site's canonical domain(s).
Conclusion
The CVE-2026-55372 vulnerability in NukeViet poses a significant risk due to its potential for SSRF attacks. It is crucial to update to the patched version or implement workarounds to protect your application from exploitation.
See every vulnerability recorded for nukeviet/nukeviet →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
If your NukeViet installation is vulnerable, an attacker can exploit this flaw to make unauthorized requests to internal services, potentially leading to information disclosure or service disruption.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner for more information.
If you cannot update immediately, implement the recommended workarounds to mitigate the risk until you can apply the patch.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nukeviet/nukeviet.
