Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-7291 Server-Side Request Forgery in o2oa Up to 10.0 FileAction Component https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7291
Post summary
A new SSRF vulnerability (CVE‑2026‑7291) has been disclosed affecting the o2oa FileAction component up to version 10.0; details are available on a vulnerability database but no PoC or exploit code is provided.
CVE-2026-7291 A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file http://FileAction.java of the component URL Fetching. Executing a manipulat… https://www.cve.org/CVERecord?id=CVE-2026-7291
Post summary
The post announces a weakness in o2oa up to version 10.0, affecting the FileAction function within the URL Fetching component, but provides no PoC, exploitation details, or patch information.