CVE-2026-82081: wallabag SSRF Vulnerability in PDF Export

CVE-2026-82081 Overview

CVE-2026-82081 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting wallabag versions 2 through 2.6.14. The flaw resides in the PDF export functionality, where a crafted title or content field is mishandled during document generation. An authenticated attacker can supply malicious input that causes the wallabag server to issue outbound HTTP requests to attacker-chosen destinations. This enables interaction with internal services that are not directly reachable from the public internet.

Critical Impact
An authenticated user can coerce the wallabag server into making arbitrary HTTP requests, exposing internal network resources and cloud metadata endpoints.

Affected Products

wallabag 2.0 through 2.6.14
Self-hosted wallabag instances exposing PDF export
Multi-user wallabag deployments accepting untrusted content

Discovery Timeline

2026-08-28 - CVE-2026-82081 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82081

Vulnerability Analysis

Wallabag is an open-source self-hosted read-it-later application that lets users save and export web articles. The application supports exporting saved entries to PDF format. During PDF generation, the rendering pipeline processes the article's title and content fields without adequately restricting embedded resource references. An attacker who authenticates to a wallabag instance can inject markup or URLs that the PDF renderer resolves server-side. The renderer then dereferences those URLs from the wallabag host, producing an SSRF condition. The scope-changed impact indicates the vulnerability crosses trust boundaries, reaching resources beyond the vulnerable component itself.

Root Cause

The root cause is missing validation of user-controlled fields consumed by the PDF export component. The renderer treats embedded references as trusted and fetches them from the server context. Wallabag does not enforce an allowlist of protocols or destination hosts before the renderer resolves external resources.

Attack Vector

Exploitation requires a low-privilege authenticated account. The attacker creates or edits an entry containing a crafted title or content payload that references an internal URL. When the attacker triggers PDF export, the server-side renderer requests the target URL, and its response can influence the generated document. Attackers commonly target internal services, cloud metadata endpoints such as 169.254.169.254, and localhost administrative interfaces.

No verified public exploit code is included here. Refer to the GitHub Security Advisory GHSA-q2g2-www6-wf5h and the public proof-of-concept disclosure for reproduction details.

Detection Methods for CVE-2026-82081

Indicators of Compromise

Outbound HTTP requests from the wallabag application server to RFC1918 addresses or 169.254.169.254.
PDF export requests correlated with entries containing unusual URLs in title or content fields.
Application logs showing PDF generation errors tied to non-standard schemes or unreachable internal hosts.

Detection Strategies

Inspect wallabag database entries for suspicious URLs, file:// schemes, or metadata endpoint references in article fields.
Correlate authenticated user activity with server-initiated network requests during PDF export operations.
Alert on wallabag process connections to cloud instance metadata services or internal management interfaces.

Monitoring Recommendations

Enable egress traffic logging on the wallabag host and forward events to a centralized analytics platform.
Baseline normal PDF export network behavior and alert on deviations to internal address ranges.
Review web server access logs for repeated /export/*.pdf requests from single accounts.

How to Mitigate CVE-2026-82081

Immediate Actions Required

Upgrade wallabag to a version later than 2.6.14 once released by the maintainers.
Restrict outbound network access from the wallabag server using host firewall rules or egress proxies.
Block wallabag from reaching cloud metadata endpoints and internal management networks.
Audit existing user accounts and disable inactive or untrusted registrations.

Patch Information

Monitor the wallabag security advisories page for the fixed release. Apply the patched version as soon as it is published and re-test PDF export functionality afterward.

Workarounds

Disable the PDF export feature until a patched release is available.
Deploy wallabag behind an egress proxy that enforces a destination allowlist.
Restrict account registration to trusted users and require administrator approval.
Apply network segmentation so the wallabag host cannot reach sensitive internal services.

bash

# Example iptables egress restriction for the wallabag host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP