Is CVE-2026-107273 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107273?

CVE-2026-107273 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-107273

Description

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.