External risk intelligence

Apache Fesod UrlImageConverter DNS Rebinding Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107460

The vulnerability exists in a component responsible for processing remote image URLs within a spreadsheet application. Applications that allow users to import or embed remote images from URLs are commonly exposed to the internet as web applications or services, making this surface reachable in typical deployment scenarios where document processing features are offered to end users.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A Server-Side Request Forgery vulnerability exists in the UrlImageConverter component of Apache Fesod (Incubating) that could allow attackers to bypass protections by using DNS rebinding. This could enable unauthorized access to restricted network addresses, potentially impacting data confidentiality and integrity. While newer versions address this by disabling remote image fetching by default, organizations using the affected component should confirm its relevance and exposure.

Allows bypassing URL image conversion security.
Critical because it bypasses existing security controls.
Confirm relevance and exposure to network risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a vulnerable application into processing a specially crafted image URL. The application's UrlImageConverter component attempts to validate the URL by resolving its IP address. However, through a technique called DNS rebinding, an attacker can manipulate DNS responses to cause the application to then connect to a restricted or internal address, potentially leading to unauthorized access or data compromise.

Requires attacker-controlled URL and DNS.
Bypasses SSRF protection via DNS rebinding.
Leads to unauthorized access to internal resources.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact applications using the UrlImageConverter component when processing attacker-controlled image URLs for spreadsheets. By bypassing DNS rebinding protections, an attacker may trick the application into connecting to restricted addresses after the initial validation of the hostname's IP addresses.

Application network access to restricted systems.
Bypassed DNS validation to reach internal addresses.
Unauthorized access or disclosure of internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Server-side request forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) requires immediate attention from application owners and platform teams. The immediate first step is to identify all instances of the affected technology, confirm their exposure and business criticality, and then assign an accountable owner to plan remediation.

Application owners should take immediate ownership.
Verify remote URL image fetching is disabled.
Plan upgrades or allowlisting of trusted hosts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Fesod?

Apache Fesod (Incubating) is an open-source software project that provides tools for spreadsheet manipulation and data processing. The affected UrlImageConverter component is specifically designed to fetch and embed images from external URLs into spreadsheets, enabling users to incorporate remote media directly into their documents.

How does DNS rebinding impact CVE-2026-107460?

This vulnerability is a Server-Side Request Forgery (CWE-918). It occurs because the application performs security validation on a hostname, but then makes a secondary connection that resolves the same hostname again. An attacker can use DNS rebinding to change the resolved IP address between the validation step and the actual connection, tricking the software into accessing restricted internal resources.

Do I need to worry about any URL for this flaw?

No. This issue requires an attacker to control the DNS server for the URL being processed. If the application is only fetching images from static, hard-coded, or internal-only domains where the DNS response cannot be manipulated by an outside party, the conditions required for this specific DNS rebinding bypass are not met.

Is my application at risk?

According to Halo Surface Signal, this vulnerability is most relevant to web applications or services that allow end-users to input or embed remote image URLs. If your instance of Apache Fesod is configured to process user-supplied URLs and is accessible from the internet, it presents a significantly higher risk of being reachable for this type of exploitation.

How do I secure my environment?

The primary response is to upgrade to version 2.1.0-incubating, which disables remote URL image fetching by default. If you must keep this feature enabled, you should implement a strict allowlist of trusted hostnames. Start by identifying all applications utilizing the UrlImageConverter component to determine if they are processing external inputs.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.