Skip to content
OpenAdvisories
High · 7.7 Public exploit CVE-2026-42141 EUVD-2026-29701

Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Published May 12, 2026 · Updated May 13, 2026 · Assigned by GitHub_M

Vendor: Xibo Signage Product: xibo-cms

Description

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can be exploited to scan internal infrastructure, access local cloud metadata endpoints (e.g., AWS IMDS), interact with internal services that lack authentication, or exfiltrate data. This vulnerability is fixed in 4.4.1.

Affected products

VendorProductAffectedFixed
xibosignage xibo-cms < 4.4.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References