CVE-2026-42194 — Server-Side Request Forgery

title: CVE-2026-42194 - Admidio fetch_metadata.php SSRF to Internal IP
id: scw-2026-05-07-ai-1
status: experimental
level: critical
description: |
  Detects requests to Admidio's fetch_metadata.php endpoint with a 'url' parameter that resolves to an internal IP address. This indicates an attempt to exploit CVE-2026-42194, which allows Server-Side Request Forgery (SSRF) by exploiting a Time-of-Check to Time-of-Use (TOCTOU) window in the DNS resolution and curl_init() call, enabling redirection to internal network resources.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42194/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      uri|contains:
          - '/fetch_metadata.php'
      cs-uri-query|contains:
          - 'url='
      dst_ip|contains:
          - '10.'
          - '192.168.'
          - '172.16.'
          - '172.17.'
          - '172.18.'
          - '172.19.'
          - '172.20.'
          - '172.21.'
          - '172.22.'
          - '172.23.'
          - '172.24.'
          - '172.25.'
          - '172.26.'
          - '172.27.'
          - '172.28.'
          - '172.29.'
          - '172.30.'
          - '172.31.'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse