CVE-2026-3286 is a Server-Side Request Forgery (SSRF) vulnerability affecting itwanger paicoding versions 1.0.0 through 1.0.3. Specifically, the Save function within the ImageRestController.java component allows for manipulation of the 'img' argument, leading to remote SSRF. The vulnerability has a CVSS v3.1 score of 6.3 (Medium), indicating a low attack complexity and requiring low privileges, but can be exploited remotely to impact confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog or having Metasploit/Nuclei exploits, public exploit code is available. Despite this, community discussion and media coverage are minimal, suggesting limited current attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0CPE matchmatch criteria | cpe:2.3:a:itwanger:paicoding:1.0.0:*:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:itwanger:paicoding:1.0.1:*:*:*:*:*:*:* | ||
1.0.2CPE matchmatch criteria | cpe:2.3:a:itwanger:paicoding:1.0.2:*:*:*:*:*:*:* | ||
1.0.3CPE matchmatch criteria | cpe:2.3:a:itwanger:paicoding:1.0.3:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.