Skip to content
OpenAdvisories

Product · basecamp

once-campfire

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2026-100355

    Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard

    Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loop…

    basecamp once-campfire