Description
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | @progress/sitefinity-nextjs-sdk | 15.1.8326 – < 15.4.8638 | 15.4.8638 |
Advisories 1
- WID-SEC-2026-3744 Progress Software Sitefinity Next.js Renderer SDK: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Oct 5, 2026