5.3
Medium
CVE-2026-105438 A flaw has been found in O2OA up to 10.0.1-ce
Description
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| O2OA | 10.0.1-ce | No fix stated |
References
- VDB-413603 | O2OA General url ActionUploadExcelWithUrl server-side request forgery vuldb.com
- VDB-413603 | CTI Indicators (IOB, IOC, IOA) vuldb.com
- CVE-2026-105438 | CVE Analysis and Report vuldb.com
- Submit #983598 | o2oa <=10.0.1-ce ssrf vuldb.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of O2OA
The 23 CVEs of O2OA →
CVE-2026-97179
A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2
5.3
Medium
CVE-2026-7292
A security vulnerability has been detected in o2oa up to 10.0
6.3
Medium
CVE-2026-7291
A weakness has been identified in o2oa up to 10.0
5.3
Medium
CVE-2026-2074
A vulnerability was identified in O2OA up to 9.0.0
5.3
Medium