CVE-2026-47170: Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint

Synopsis

A server-side request forgery (SSRF) vulnerability affects Garlic-Hub, a self-hosted digital signage management platform. The flaw is reachable over the network and requires only a low-privilege authenticated account; no victim interaction is needed. A successful attacker can direct the Garlic-Hub server to issue arbitrary HTTP requests against internal services, enabling internal port scanning, service fingerprinting, and exfiltration of internal HTTP responses via the publicly accessible media pool. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The uploadFromUrl endpoint is exposed over the network, so the attacker must be able to reach the Garlic-Hub instance across the internet or an internal network.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient to trigger the SSRF; no administrative or elevated permissions are needed.

• Victim interactionNot required

  The attacker makes direct HTTP requests to the vulnerable endpoint; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors need to be in place.

Blast Radius

• Reads HTTP responses from internal services (configuration endpoints, metadata APIs, internal dashboards) and stores them in the publicly accessible media pool where any unauthenticated visitor can retrieve them.
• Maps the internal network by probing arbitrary host-and-port combinations and inferring service availability from HTTP response codes and bodies.
• Fingerprints internal services (version strings, software identities) to support follow-on attacks against those systems.
• Confidentiality of internal infrastructure is fully compromised; the CVSS vector records no integrity or availability impact, so the attacker cannot directly modify data or cause outages through this bug alone.