CVE-2026-111720: fish-island-backend affected git revisions

Affected technology

fish-island-backend · 0 through 7c61b7861e99d3970beb34103c244b79e4de7d88
lhccong

Description’s affected range: through commit 7c61b78

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Remote attackers can make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as low; integrity and availability impact as none.