Codiad SSRF Vulnerability

HIGH 7.2CVE-2020-14044 · GHSA-c3q8-hh69-7mg5 · Published 24/08/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
codiad/codiad Packagist	`≥ 1.7.8, ≤ 2.8.4`	No fix yet
codiad codiad	`≥ 1.7.8`	No fix yet

Description

A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."

NVD description

** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states "Codiad is no longer under active maintenance by core contributors."

References

nvd.nist.gov/vuln/detail/CVE-2020-14044 · ADVISORY
Codiad/Codiad · WEB
Codiad/Codiad · WEB
advisory.checkmarx.net/advisory/CX-2020-4280 · WEB
Codiad/Codiad · PACKAGE
Codiad/Codiad · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free