CVE-2026-86119

Webstudio through version 0.296.0 contains an unauthenticated server-side request forgery vulnerability (CWE-918) in its /cgi/image, /cgi/video, and /cgi/asset proxy routes, triggered when the RESIZE_ORIGIN environment variable is unset. Because these endpoints accept attacker-supplied URLs and the server fetches them, a remote unauthenticated attacker can direct the host to request arbitrary internal or external resources. Successful abuse allows the attacker to read cloud instance metadata, reach internal services, and perform network reconnaissance against the hosting infrastructure. Any Webstudio deployment at version 0.296.0 or earlier that has not set RESIZE_ORIGIN and exposes these proxy routes is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS assigns a roughly 0.3% probability of exploitation within 30 days.

What to do: As an immediate mitigation, set the RESIZE_ORIGIN environment variable to a trusted origin on affected deployments and restrict or remove public access to /cgi/image, /cgi/video, and /cgi/asset. Upgrade to a Webstudio release newer than 0.296.0 once the project publishes a fixed version, and check whether your instance runs in a cloud environment with an instance metadata service; blocking egress to the metadata endpoint (169.254.169.254) reduces the impact of any SSRF. Review logs for requests to these proxy routes containing unusual or internal target URLs.