CVE-2026-10287: SSRF in SourceCodester SEO Meta Tag Extractor 1.0

Technical summary

CVE-2026-10287 is a CWE-918 server-side request forgery vulnerability in SourceCodester SEO Meta Tag Extractor 1.0. The get_headers function in /index.php fails to properly validate the url parameter, allowing an unauthenticated attacker to inject arbitrary URLs. This causes the server to issue HTTP requests to attacker-specified destinations, bypassing network segmentation and access controls. The vulnerability has a CVSS v3.1 score of 7.3 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating low attack complexity, no privileges required, and impacts on confidentiality, integrity, and availability.

Business impact

An SSRF vulnerability in a publicly exposed web application poses significant operational risk. Attackers can probe and access internal services (databases, admin panels, cloud metadata endpoints), intercept sensitive data, or manipulate internal systems. If the affected instance can reach critical infrastructure or cloud environments, the blast radius extends to those assets. Organizations relying on this tool for SEO metadata extraction may face data breaches, lateral movement into their infrastructure, or denial of service. The public disclosure and availability of exploit code accelerates real-world attack timelines.

Affected systems

SourceCodester SEO Meta Tag Extractor version 1.0 is vulnerable. Organizations running this application should immediately inventory affected deployments. The vulnerability requires network access to the /index.php endpoint; exposure depends on whether the application is internet-facing, on an internal network, or air-gapped. Verify your version against the application vendor's release information.

Exploitability

This vulnerability is highly exploitable. No authentication, special privileges, or user interaction is required. Attack complexity is low—an attacker simply crafts a malicious URL parameter and sends it to the get_headers function. Proof-of-concept code has been publicly disclosed, lowering the barrier to exploitation. The threat is immediate and actionable by any networked attacker.

Remediation

Upgrade SourceCodester SEO Meta Tag Extractor to a patched version beyond 1.0 as soon as the vendor releases one. Pending a patch, implement network-level controls: restrict outbound traffic from the server to only legitimate destinations, use a Web Application Firewall (WAF) to block suspicious URL parameters, and disable or remove the application from production if it is not critical. If the tool is only used internally, restrict network access to trusted subnets.

Patch guidance

Contact SourceCodester or check their official repository for patched versions. Verify the patch version against the vendor's security advisory before deployment. Apply patches in a test environment first to ensure compatibility with your SEO workflow. If no patch is available at the time of assessment, prioritize mitigation controls until one is released.

Detection guidance

Monitor HTTP request logs for the /index.php endpoint, particularly requests with suspicious url parameters pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, or cloud metadata services (169.254.169.254). Look for unusual outbound connections from the application server to unexpected destinations. Deploy WAF rules to detect and block common SSRF payloads. Correlate application logs with network traffic to identify exploitation attempts.

Why prioritize this

Despite not being on the CISA KEV list, this vulnerability merits immediate prioritization because: (1) public exploits reduce time-to-compromise to hours or minutes, (2) SSRF flaws enable lateral movement and data exfiltration, (3) no authentication is required, (4) the attack surface is network-accessible by design. Any internet-facing instance should be treated as critical. Even internal deployments pose risk if the server can reach sensitive systems.

Risk score, explained

The CVSS 7.3 (HIGH) score reflects the network-exploitable nature, absence of access controls, and multi-faceted impact on confidentiality, integrity, and availability. The score appropriately weights the ease of exploitation and the attacker's ability to weaponize the flaw for reconnaissance and lateral movement. The public availability of exploit code is not factored into CVSS but substantially elevates practical risk in your environment.

Frequently asked questions