High severity8.2NVD Advisory· Published Sep 25, 2026

CVE-2026-100391

Description

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mediaflow Proxy/mediaflow-proxyllm-create
Range: <=2.4.9
Mhdzumair/mediaflow-proxyllm-create
Range: <=2.4.9

Patches

Vulnerability mechanics

References

github.com/mhdzumair/mediaflow-proxy/blob/2.4.9/mediaflow_proxy/routes/proxy.pynvd
github.com/mhdzumair/mediaflow-proxy/commit/99f4af1153d4766420a098a232183cba1efdc560nvd
www.vulncheck.com/advisories/mediaflow-proxy-through-2.4.9-server-side-request-forgery-via-incomplete-validationnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000