AIKIDO-2026-270050
craftcms/feed-me is vulnerable to Server-Side Request Forgery (SSRF)
77
High Risk
This Affects:
craftcms/feed-meTL;DR
Feed Me resolves a user-supplied feed URL or path through Craft::getAlias() and reads it with file_get_contents(), falling back to an HTTP client when the target is not a local file, without validating the destination. A control panel user with Feed Me access can supply local paths such as @root/.env to read arbitrary files, or internal and external URLs to reach internal services and cloud instance metadata endpoints. The permissive CSV parser makes exfiltration of the fetched content straightforward. The fix validates the feed URL and enforces allowed filesystem paths and IP restrictions before fetching.
Who does this affect?
You are affected if you are running a version within the vulnerable range.
Background info
craftcms/feed-me is vulnerable to Server-Side Request Forgery (SSRF) in versions 6.0.0 - 6.13.0.1.
How to fix this
Upgrade the craftcms/feed-me library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant