Squidex vulnerabilities
We track 5 vulnerabilities in Squidex products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 22, 2026.
Latest Squidex vulnerabilities
- 7.3 High severity
squidex: Server-Side Request Forgery
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network
- 7.3 High severity
squidex: Server-Side Request Forgery
Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vulnerability due to missing SSRF protection on the `Jint` HTTP client used by scripting engine function
- 7.2 High severity
squidex: Server-Side Request Forgery
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fe
- 8.8 High severity
squidex: Server-Side Request Forgery
Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration
- 7.2 High severity
squidex: Improper Limitation of a Pathname to a Restricted Directory
Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution (RCE). Squidex allows u