CVE-2026-86119

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.

  • Published Sep 5, 2026
  • CVSS 9.2 critical
  • 0.6% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86119 at the National Vulnerability Database