CVE-2026-49328 Overview
CVE-2026-49328 is a Server-Side Request Forgery (SSRF) vulnerability in the UrlImageConverter component of Apache Fesod (Incubating). Versions of fesod-sheet before 2.0.2-incubating accept user-supplied image URLs and trigger outbound network requests without adequate validation. Attackers can abuse this to reach internal or otherwise restricted resources from the server. The flaw is tracked under CWE-918 and affects Apache Fesod when processing spreadsheet content that references remote images. The Apache Fesod project recommends upgrading to 2.0.2-incubating, which addresses the issue.
Critical Impact
Unauthenticated attackers can coerce the Fesod server into issuing HTTP requests to internal endpoints, enabling reconnaissance of internal services and exposure of restricted resources.
Affected Products
- Apache Fesod (Incubating) fesod-sheet versions prior to 2.0.2-incubating
- Applications embedding the vulnerable UrlImageConverter component
- Deployments processing spreadsheets with externally controlled image URLs
Discovery Timeline
- 2026-06-01 - CVE-2026-49328 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-49328
Vulnerability Analysis
Apache Fesod is a spreadsheet processing library. The fesod-sheet module includes a UrlImageConverter helper that fetches remote images referenced in spreadsheet content. The converter accepts user-supplied URLs and issues outbound HTTP requests from the server-side runtime.
Because the URL is not constrained to expected hosts, schemes, or address ranges, an attacker controlling the image URL can direct the server to contact arbitrary destinations. Targets include cloud metadata endpoints such as 169.254.169.254, internal management consoles, and services on localhost. The vulnerability is classified as Server-Side Request Forgery under CWE-918.
The impact is bounded to confidentiality, with no direct integrity or availability effect. Successful exploitation can disclose information returned in the response, banner data, or differential timing that reveals whether internal hosts and ports are reachable.
Root Cause
The root cause is missing validation of user-controlled URLs inside UrlImageConverter. The component trusts the supplied URL and performs a network fetch without enforcing an allowlist, blocking private address ranges, or restricting schemes. Reference details are documented in the Apache Fesod pull request 917 and the Apache mailing list discussion.
Attack Vector
An attacker supplies a crafted image URL through any input that Fesod processes as a spreadsheet image reference. This may occur via uploaded workbooks, API-driven sheet generation, or templates rendered by an application built on fesod-sheet. When Fesod resolves the image, the server issues an outbound request to the attacker-chosen destination and returns observable behavior to the caller.
// No verified public exploit code is available for CVE-2026-49328.
// Refer to https://github.com/apache/fesod/pull/917 for the upstream fix.
Detection Methods for CVE-2026-49328
Indicators of Compromise
- Outbound HTTP requests from Fesod hosts to private RFC1918 ranges, 127.0.0.0/8, or link-local addresses such as 169.254.169.254
- Spreadsheet inputs containing image URLs pointing to internal hostnames, cloud metadata endpoints, or non-HTTP schemes
- Unexpected response sizes or latencies from Fesod when processing user-supplied workbooks
Detection Strategies
- Inspect application logs for UrlImageConverter activity and correlate fetched URLs against an allowlist of expected image hosts
- Monitor egress proxies for image fetches originating from Fesod service accounts to non-public destinations
- Add web application firewall (WAF) rules that flag inbound payloads containing image URLs referencing internal IP literals or metadata endpoints
Monitoring Recommendations
- Forward Fesod application and egress proxy logs to a centralized analytics platform for correlation
- Alert on outbound DNS resolution from Fesod hosts to internal zones not part of normal operation
- Track installed fesod-sheet versions across the fleet and flag any release earlier than 2.0.2-incubating
How to Mitigate CVE-2026-49328
Immediate Actions Required
- Upgrade fesod-sheet to 2.0.2-incubating or later, as documented in the Apache FESOD 2.0.2 release notes
- Audit applications that pass user-controlled URLs into Fesod image processing paths
- Restrict egress from Fesod hosts to only the destinations required for normal operation
Patch Information
The Apache Fesod project fixed CVE-2026-49328 in 2.0.2-incubating. The change is detailed in pull request 917 and announced through the Apache mailing list and the Openwall OSS-Security update. Download instructions are available in the Apache FESOD documentation.
Workarounds
- Disable processing of remote image URLs in spreadsheets if the feature is not required
- Route Fesod outbound traffic through an egress proxy that enforces an allowlist of permitted image hosts
- Block requests to private address ranges and cloud metadata endpoints at the network layer
# Example: block Fesod egress to internal and metadata ranges using iptables
iptables -A OUTPUT -m owner --uid-owner fesod -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fesod -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fesod -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fesod -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fesod -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
