CVE-2026-59095: Lobehub

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target internal addresses such as cloud instance metadata endpoints through these unprotected code paths to disclose internal service responses and cloud credentials.

Affected products

• Lobehub Lobehub: before 2.2.10 (fixed in 2.2.10)

Published 2026-07-02. Last modified 2026-09-30.