Description
PUT /api/basemap (the basemap import endpoint) fetches an attacker-supplied URL server-side with no SSRF protection whatsoever. Any authenticated user can submit a JSON body { "type": "...", "url": "<attacker url>" }; the server calls fetch(url) against that URL and then reflects the response body (name, attribution, tiles[0], zoom levels) back to the caller in the OptionalTileJSON response.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 13.5.0
References
Could your website be exposed too?
SmartScanner can check your website for TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification g and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification - CVE-2026-55177
- Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 - CVE-2026-34526
You might also like:
See something that needs correcting? Let us knowUpdated July 17, 2026