https://cti.al/tags/ssrf/Recent content in Ssrf on cti.alHugoen-usWed, 03 Jun 2026 11:00:00 +0200https://cti.al/posts/zammad-ssrf-webhooks-cve-2026-34719/Wed, 03 Jun 2026 11:00:00 +0200https://cti.al/posts/zammad-ssrf-webhooks-cve-2026-34719/Zammad's webhook endpoint validation checked only scheme and hostname — never the resolved IP — so a webhook could be pointed straight at loopback, RFC 1918, or the cloud metadata service, and the response read back from the HTTP logs.