CVE-2026-7084
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. It affects the fetch function of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the getCodeByLink Endpoint component. Manipulation of the Link argument results in server-side request forgery. There is ongoing doubt regarding the real existence of this vulnerability.
Risk Assessment
The SSRF vulnerability may allow an attacker to make server-side requests to internal resources. The vendor notes the interface is high-risk and requires informed use.
Recommendation
Restrict access to the getCodeByLink endpoint and implement validation of the Link argument, and consider updating to a newer version.
Other vulnerabilities in Toonflow-app
See all- CVE-2026-109526Low
In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.
- CVE-2026-109409Medium
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
- CVE-2026-7086Medium
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1 affecting the updateStoryboardUrl function in replaceUrl.ts of the Storyboard Export component; manipulation of the url argument leads to path traversal. The attack can be launched remotely and a public exploit may be used. The vendor states the URL is designed to be local or trusted unless the user modifies the code.
- CVE-2026-7085Medium
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1 in the z.url function of src/routes/setting/about/downloadApp.ts (downloadApp Endpoint), where manipulation of the url argument causes path traversal. The attack can be initiated remotely, is considered high complexity, and the exploit has been publicly disclosed. The real existence of this vulnerability is still doubted, and the vendor states the update URL is statically compiled in the official repository.
Original NVD description (English source)
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that "[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS