Is CVE-2026-111662 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111662?

CVE-2026-111662 has a CVSS v3 severity of MEDIUM (5.8).

Back

CVE-2026-111662

Description

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.