CVE-2026-92931: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

Server-side request forgery in the Progress @progress/sitefinity-nextjs-sdk npm package. Remote attackers may be able to make server-side requests to attacker-controlled hosts, potentially exposing sensitive information.

CVE ID

CVE-2026-92931

Vendor

Progress Sitefinity

Product

@progress/sitefinity-nextjs-sdk (npm)

Weakness

CWE-918 — Server-Side Request Forgery (SSRF)

CVSS 3.1

8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected

15.1.8326 through 15.4.8637

Fixed in

15.4.8638

Published

Oct 05, 2026

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz) — finder

Assigner (CNA)

Progress Software

Remediation

Upgrade @progress/sitefinity-nextjs-sdk to 15.4.8638 or later.

References

About this disclosure

This vulnerability was found and reported by Abhishek Nandkumar Bhaskar (Abhi HackZ, credited in the CVE record as Abhi-Hackz) through the Progress Sitefinity VDP (Bugcrowd), and credited to him as finder in the official CVE record assigned by Progress Software as the CVE Numbering Authority. Proof-of-concept details are withheld; the facts on this page are taken from the public CVE record and the vendor advisory. For the background and the bug class explained, read Four CVEs in Progress Software Products and From a Bugcrowd VDP Report to a Published CVE.

Other CVEs credited to Abhishek Bhaskar