Is CVE-2026-86119 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86119?

CVE-2026-86119 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-86119

Description

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, access internal services, and perform network reconnaissance on the instance infrastructure.