CVE-2026-47170

@@ -39,6 +39,7 @@
 use App\Modules\Mediapool\Services\UploadService;
 use App\Modules\Mediapool\Utils\ImagickFactory;
 use App\Modules\Mediapool\Utils\MediaHandlerFactory;
+use App\Modules\Mediapool\Utils\SsrfValidator;
 use App\Modules\Mediapool\Utils\ZipFilesystemFactory;
 use GuzzleHttp\Client;
 use Psr\Container\ContainerInterface;
@@ -85,6 +86,10 @@
 		)
 	);
 });
+$dependencies[SsrfValidator::class] = DI\factory(function (ContainerInterface $container) {
+	return new SsrfValidator();
+});
+
 $dependencies[UploadService::class] = DI\factory(function (ContainerInterface $container)
 {
 	return new UploadService(
@@ -93,6 +98,7 @@
 		new Client(),
 		new FilesRepository($container->get('SqlConnection')),
 		$container->get(MimeTypeService::class),
+		$container->get(SsrfValidator::class),
 		$container->get('ModuleLogger')
 	);
 });

@@ -27,6 +27,7 @@
 use App\Modules\Mediapool\Repositories\FilesRepository;
 use App\Modules\Mediapool\Utils\AbstractMediaHandler;
 use App\Modules\Mediapool\Utils\MediaHandlerFactory;
+use App\Modules\Mediapool\Utils\SsrfValidator;
 use Doctrine\DBAL\Exception;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\GuzzleException;
@@ -50,6 +51,7 @@ public function __construct(
 		private Client              $client,
 		private FilesRepository     $mediaRepository,
 		private MimeTypeService     $mimeTypeDetector,
+		private SsrfValidator       $ssrfValidator,
 		private LoggerInterface     $logger)
 	{
 	}
@@ -121,8 +123,11 @@ public function uploadExternalMedia(int $nodeId, int $UID, string $externalLink,
 	{
 		try
 		{
+
 			$this->checkNodeUploadable($nodeId, $UID);
-			$response      = $this->client->head($externalLink);
+			$resolved      = $this->ssrfValidator->validateAndResolveUrl($externalLink);
+			$curlOpts      = ['curl' => [CURLOPT_RESOLVE => ["{$resolved['host']}:{$resolved['port']}:{$resolved['ip']}"]]];
+			$response      = $this->client->head($externalLink, $curlOpts);
 			$preMimeType   = $response->getHeaderLine('Content-Type');
 			// workaround if no content-type sent
 			if ($preMimeType === '' && (str_contains($externalLink, 'mp4') ||
@@ -132,7 +137,7 @@ public function uploadExternalMedia(int $nodeId, int $UID, string $externalLink,
 			$contentLength = $response->getHeaderLine('Content-Length');
 			$mediaHandler  = $this->mediaHandlerFactory->createMediaHandler($preMimeType);
 			$mediaHandler->checkFileBeforeUpload((int) $contentLength);
-			$uploadPath    = $mediaHandler->uploadFromExternal($this->client, $externalLink);
+			$uploadPath    = $mediaHandler->uploadFromExternal($this->client, $externalLink, $curlOpts);
 
 			$ret = $this->insertDataset($mediaHandler, $uploadPath, $nodeId, $UID, $extMetadata);
 		}

@@ -22,7 +22,6 @@
 namespace App\Modules\Mediapool\Utils;
 
 use App\Framework\Core\Config\Config;
-use App\Framework\Exceptions\CoreException;
 use App\Framework\Exceptions\ModuleException;
 use GuzzleHttp\Client;
 use GuzzleHttp\Exception\GuzzleException;
@@ -63,7 +62,6 @@ abstract class AbstractMediaHandler
 	/**
 	 * @param Config $config
 	 * @param Filesystem $filesystem
-	 * @throws CoreException
 	 */
 	public function __construct(Config $config, Filesystem $filesystem)
 	{
@@ -157,9 +155,10 @@ public function uploadFromLocal(UploadedFileInterface $uploadedFile): string
 	}
 
 	/**
+	 * @param array{curl: array<int, mixed>} $curlOpts
 	 * @throws GuzzleException
 	 */
-	public function uploadFromExternal(Client $client, string $fileURI): string
+	public function uploadFromExternal(Client $client, string $fileURI, array $curlOpts): string
 	{
 		/** @var array{path: string} $parsedUrl */
 		$parsedUrl  = parse_url($fileURI);
@@ -168,7 +167,7 @@ public function uploadFromExternal(Client $client, string $fileURI): string
 		$pathInfo   = pathinfo($parsedUrl['path']);
 		$targetPath = strtolower('/'. $this->originalPath .'/'. $pathInfo['basename']);
 
-		$client->request('GET', $fileURI, ['sink' => $this->getAbsolutePath($targetPath)]);
+		$client->request('GET', $fileURI, array_merge(['sink' => $this->getAbsolutePath($targetPath)], $curlOpts));
 		return $targetPath;
 	}
 
@@ -201,6 +200,10 @@ public function determineNewFilePath(string $oldFilePath, string $filehash, stri
 		return $fileInfo['dirname']. '/'.$filehash.'.'.$ext;
 	}
 
+	/**
+	 * @throws ModuleException
+	 * @throws FilesystemException
+	 */
 	public function writeBinaryString(string $filePath, string $binaryContent): void
 	{
 		if ($binaryContent === '')

@@ -0,0 +1,55 @@
+<?php
+/*
+ garlic-hub: Digital Signage Management Platform
+
+ Copyright (C) 2026 Nikolaos Sagiadinos <garlic@saghiadinos.de>
+ This file is part of the garlic-hub source code
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License, version 3,
+ as published by the Free Software Foundation.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+declare(strict_types=1);
+
+
+namespace App\Modules\Mediapool\Utils;
+
+class SsrfValidator
+{
+	/**
+	 * @return array{ip: string, host: string, port: int, path: string}
+	 */
+	public function validateAndResolveUrl(string $url): array
+	{
+		$parsed = parse_url($url);
+
+		if (!isset($parsed['scheme'], $parsed['host']))
+			throw new \InvalidArgumentException('Invalid URL.');
+
+		if (!in_array($parsed['scheme'], ['https', 'http'], true))
+			throw new \InvalidArgumentException('URL scheme not allowed.');
+
+		$host = $parsed['host'];
+		$port = $parsed['port'] ?? ($parsed['scheme'] === 'https' ? 443 : 80);
+		$ip   = gethostbyname($host);
+
+		if ($ip === $host)
+			throw new \InvalidArgumentException('DNS resolution failed.');
+
+		if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false)
+			throw new \InvalidArgumentException('URL resolves to forbidden IP range.');
+
+		if (str_starts_with($ip, '169.254.'))
+			throw new \InvalidArgumentException('URL resolves to forbidden IP range.');
+
+		return ['ip' => $ip, 'host' => $host, 'port' => $port, 'path' => $parsed['path'] ?? '/'];
+	}
+}
\ No newline at end of file