Vulnerability in Progress Software @progress/sitefinity-nextjs-sdk

[ Description ]Official description

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund5 Oct 2026WID-SEC-2026-3744

  Progress Software Sitefinity Next.js Renderer SDK: Vulnerability allows file manipulation Translated from German

  CVE-2026-92931

[ References ]References

• community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-S…