URL Restriction Bypass in plantuml/plantuml

published 2022-05-14 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-24699

cvss: 7.2; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Patch / fix

fixed in 1 links 2

plantuml plantuml/plantuml V1.2022.5

github.com/plantuml/plantuml@93e5964 commit
huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1379 updated 2025-11-21 cvss 7.1

plantuml: URL Restriction Bypass

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.62% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.dev https://huntr.dev/bounties/0d737527-86e1-41d1-9d37-b2de36bc063a referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.2	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

plantuml plantuml/plantuml

Classification

Weakness

CWE-918 Server-Side Request Forgery

References

github.com /plantuml/plantuml/commit/93e5964e5f35914f3f7b89de620c596795550083
patch, third-party-advisory
huntr.dev /bounties/0d737527-86e1-41d1-9d37-b2de36bc063a
exploit, patch, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/CHUE4G5CAJUD7L2QPJF6U4JYQTP7CNNL/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/J4DP36G2VBOZUNQIUZ5LVJKZIVO4SDAI/
vendor-advisory

Sources

CVE List CVE-2022-1379
NVD CVE-2022-1379

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary