WID-SEC-2026-3744 — Progress Software Sitefinity Next.js Renderer SDK: Schwachstelle ermöglicht Manipulation von Dateien

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Progress Software Sitefinity Next.js Renderer SDK ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Progress Sitefinity ist eine .NET Web Content Management Plattform.

Vulnerabilities 1

High 8.8

CVE-2026-92931

CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive infor…

Progress Software @progress/sitefinity-nextjs-sdk

Oct 5, 2026

Revision history

2026-10-05 #1
Initiale Fassung

References

Sitefinity Critical Security Advisory vom 2026-10-05
https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026
GitHub Security Advisory GHSA-j5cj-5p4r-rxhj vom 2026-10-05
https://github.com/advisories/GHSA-j5cj-5p4r-rxhj