{"items":[{"id":"NVI-00013774","kind":"vulnerability","title":"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vqrw-qphh-p34v","CVE-2026-54546"],"plain_summary":"GitHub lists this reviewed advisory for @tak-ps/cloudtak. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-00aced11b6e3b3ef1141c9bc9f9800d5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T17:03:17.000Z","value":"5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-00aced11b6e3b3ef1141c9bc9f9800d5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-00aced11b6e3b3ef1141c9bc9f9800d5","url":"https://github.com/advisories/GHSA-vqrw-qphh-p34v","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vqrw-qphh-p34v","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T19:09:30.244Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-00aced11b6e3b3ef1141c9bc9f9800d5"],"technology":"@tak-ps/cloudtak","known_exclusions":[],"conditions_summary":"### Summary\n\n`PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSRF protection whatsoever**. Any authenticated user can submit a JSON body `{ \"type\": \"...\", \"url\": \"\" }`; the server calls `fetch(url)` against that URL and then reflects the response body (`name`, `attribution`, `tiles[0]`, zoom levels) back to the caller in the `OptionalTileJSON` response.\n\nBecause there is no IP-address classification, internal-only services are reachable: cloud metadata (`http://169.254.169.254/...`), loopback (`http://127.0.0.1/...`), RFC1918 ranges, and CGNAT. The response body flows back to the attacker, making this a **full-read SSRF** (not blind): the attacker reads the internal HTTP response verbatim. This enables theft of cloud instance credentials, internal service enumeration, and reading of internal-only HTTP endpoints from the network position of the CloudTAK API server.\n\nThe only URL check in the basemap protocol layer (`BasemapProtocol.isValidURL`, `api/lib/interface-basemap.ts`) validates the scheme is `http`/`https` only and performs **no host/IP filtering** — and the import path does not even call it; it goes strai","public_affected_ranges":["< 13.22.1"]}],"null_published_at":"2026-11-02T10:00:37.146Z","source_updated_at":"2026-09-17T17:03:17.000Z","source_disclosed_at":"2026-07-17T19:02:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T19:09:30.244Z"}],"next_cursor":null,"snapshot_revision":"42594"}