CVE-2023-50266

    Dashboard / Vulnerabilities / CVE-2023-50266

    CVE-2023-50266

    Published: 15 Dec 2023Last Modified: 12 Aug 2026

    Summary: Bazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint

    Details: Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.

    References: https://github.com/morpheus65535/bazarr/releases/tag/v1.3.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50266.json, https://nvd.nist.gov/vuln/detail/CVE-2023-50266, https://securitylab.github.com/advisories/GHSL-2023-192_GHSL-2023-194_bazarr/, https://github.com/morpheus65535/bazarr/commit/17add7fbb3ae1919a40d505470d499d46df9ae6b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6e7858fc7ce0905ba1f241885c386d70507f6b56
    Fixed -17add7fbb3ae1919a40d505470d499d46df9ae6b

    Affected versions

    1.2.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-50266 | CVE-DB