CVE-2026-120416
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Nov 2, 2026
CISA due date
—
The record
A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newspaper/extractors/image_extractor.py of the component Image Extractor. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. Upgrading to version 0.9.6.1 mitigates this issue. The name of the patch is eec5fab21897c14667c98f5ba1831ebd3a692dd4. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121581 A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. CWE-918
- CVE-2026-121580 Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server… CWE-918
- CVE-2026-120715 Server-side request forgery in the Active Directory credential validation in Devolutions… CWE-918
- CVE-2026-105822 The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability… CWE-918
- CVE-2026-121561 Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request… CWE-918
- CVE-2026-114582 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-111362 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-121431 AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows… CWE-918