Server-Side Request Forgery in Wegow PDF export
Ticket sales chart PDF export functionality in backoffice.wegow.com.
INCIBE has coordinated the publication of a Server-Side Request Forgery (SSRF) vulnerability reported in the PDF export functionality of Wegow by Wegow Technologies. The vulnerability was discovered by Cosme Vázquez Tomé.
This vulnerability has been assigned the following CVE identifier. The CVSS v4.0 base score and vector are pending validation:
- CVE-2026-101300: CVSS V4: 0 7.1 | CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N | CWE-918
No solution has been reported at this time.
CVE-2026-101300: Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-101300 | Alta | No | Wegow |
