{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-129485", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-15T13:51:18.373Z", "datePublished": "2026-11-15T15:33:11.009Z", "dateUpdated": "2026-11-15T15:33:11.009Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-15T15:33:11.009Z"}, "datePublic": "2026-11-09T00:00:00.000Z", "title": "Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes", "descriptions": [{"lang": "en", "value": "Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "affected": [{"vendor": "yuzutech", "product": "kroki", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "0.36.0"}, {"version": "0.36.0", "status": "unaffected", "versionType": "semver"}], "packageURL": "pkg:maven/io.kroki/kroki-server", "repo": "https://github.com/yuzutech/kroki"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-jwh8-j584-79hp", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-jwh8-j584-79hp)"}, {"url": "https://github.com/yuzutech/kroki/commit/becd3b4a86754cb08d0fe54f65e92a6cab542409", "tags": ["patch"]}, {"url": "https://github.com/yuzutech/kroki/releases/tag/v0.36.0", "tags": ["release-notes"], "name": "kroki v0.36.0 Release Notes"}, {"url": "https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Blockdiag.java#L64-L85", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/kroki-before-0.36.0-ssrf-via-blockdiag-icon-and-background-attributes"}], "credits": [{"lang": "en", "value": "oceanwarranty (Adgepuk Research)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/io.kroki/kroki-server", "product": "kroki", "repo": "https://github.com/yuzutech/kroki", "vendor": "yuzutech", "versions": [{"lessThan": "0.36.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "0.36.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unauthenticated attackers to make server requests via node icon and background attributes. Attackers can send crafted diagrams to POST /blockdiag/svg or sibling endpoints to query internal services or cloud metadata and read local image files from the server."}], "id": "CVE-2026-129485", "lastModified": "2026-11-15T16:16:56.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-15T16:16:56.473", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/yuzutech/kroki/blob/v0.35.0/server/src/main/java/io/kroki/server/service/Blockdiag.java#L64-L85"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/yuzutech/kroki/commit/becd3b4a86754cb08d0fe54f65e92a6cab542409"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/yuzutech/kroki/releases/tag/v0.36.0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/yuzutech/kroki/security/advisories/GHSA-jwh8-j584-79hp"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/kroki-before-0.36.0-ssrf-via-blockdiag-icon-and-background-attributes"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.36.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.36.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kroki", "source": "cna", "vendor": "yuzutech"}, "product": "kroki", "vendor": "yuzutech"}], "created": "2026-11-15T16:30:09.440505+00:00", "updated": "2026-11-15T17:15:15.878027+00:00", "vendors": ["yuzutech", "yuzutech$PRODUCT$kroki"]}