CVE-2026-39670

MediumCVSS 6.0

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

A Server-Side Request Forgery vulnerability in the Visual Link Preview plugin allows sending requests from the server to internal resources. The issue affects versions up to and including 2.3.0.

Risk Assessment

An attacker could use the server to scan internal networks, access sensitive data, or launch attacks against other systems.

Recommendation

Update the Visual Link Preview plugin to the latest version that includes restrictions on outgoing requests.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through <= 2.3.0.