CVE-2026-75332 Overview
CVE-2026-75332 is a Server-Side Request Forgery (SSRF) vulnerability in Zyplayer-Doc versions <=1.0.0. The flaw resides in the WikiPageWebService.download() method, which processes attacker-controlled URLs without sufficient validation. An attacker can coerce the server into issuing HTTP requests to arbitrary destinations, including internal network resources otherwise unreachable from the public internet.
Critical Impact
Attackers can abuse the vulnerable server to probe internal networks, reach cloud metadata endpoints, or interact with services behind the perimeter.
Affected Products
- Zyplayer-Doc versions <=1.0.0
Discovery Timeline
- 2026-08-26 - CVE-2026-75332 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75332
Vulnerability Analysis
Zyplayer-Doc is an open-source documentation and wiki platform. The WikiPageWebService.download() function accepts a URL parameter and performs a server-side HTTP fetch against that address. The service does not validate whether the destination is an internal or restricted address before dispatching the request.
Because the request originates from the application server, it inherits the trust boundary of that host. Responses or side effects from internal endpoints can be relayed back to the attacker, enabling reconnaissance and interaction with services that assume all internal callers are trusted.
Root Cause
The root cause is missing destination validation in the download handler. The application treats user-supplied URLs as safe inputs and forwards them to the HTTP client without enforcing an allowlist, blocking private CIDR ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8), or restricting protocol schemes.
Attack Vector
An authenticated or unauthenticated attacker, depending on deployment, submits a crafted URL to the wiki page download endpoint. Targets include cloud instance metadata services such as http://169.254.169.254/, internal admin panels, and non-HTTP protocols where the underlying client supports them. See the public technical write-up on GitHub for reproduction steps.
Detection Methods for CVE-2026-75332
Indicators of Compromise
- Outbound HTTP requests from the Zyplayer-Doc application server to internal or link-local addresses such as 169.254.169.254, 127.0.0.1, or RFC1918 ranges.
- Access log entries against the wiki download endpoint containing URL parameters pointing to non-public hosts.
- Unexpected DNS resolutions initiated by the Zyplayer-Doc process for internal hostnames.
Detection Strategies
- Inspect application logs for calls to WikiPageWebService.download() with URL arguments that reference private, loopback, or metadata endpoints.
- Correlate egress firewall telemetry with the Zyplayer-Doc host to identify unusual internal-to-internal traffic patterns.
- Deploy web application firewall (WAF) rules that flag download parameters containing IP literals or non-HTTP(S) schemes.
Monitoring Recommendations
- Alert on any outbound connection from the wiki server to cloud metadata IPs.
- Baseline normal destinations for the application and alert on deviations.
- Enable verbose HTTP client logging within Zyplayer-Doc to capture the resolved target of every download call.
How to Mitigate CVE-2026-75332
Immediate Actions Required
- Restrict egress from the Zyplayer-Doc server so it can only reach explicitly required external destinations.
- Block access from the application host to cloud metadata endpoints, including 169.254.169.254 and IMDSv1 interfaces.
- Require authentication on the wiki download endpoint if it is currently exposed anonymously.
Patch Information
No vendor patch has been published in the referenced advisory at the time of writing. Monitor the Zyplayer-Doc CVE documentation and upstream project releases for a fixed version above 1.0.0.
Workarounds
- Place the application behind a forward proxy that enforces an allowlist of permitted download destinations.
- Reject URLs that resolve to private, loopback, or link-local addresses before invoking the download logic.
- Restrict supported URL schemes to http and https, blocking file://, gopher://, and ftp://.
# Example egress restriction using iptables to block metadata and RFC1918 targets
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
