Server-side Request Forgery (SSRF) Affecting jleehr/canto-saas-api package, versions <3.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-JLEEHRCANTOSAASAPI-17660436
- published27 Jun 2026
- disclosed19 Jun 2026
- creditjleehr
Introduced: 19 Jun 2026
NewCVE-2026-55374 (opens in a new tab)How to fix?
Upgrade jleehr/canto-saas-api to version 3.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the buildRequestUrl function. An attacker can access or modify unintended API endpoints by supplying crafted path variables containing special characters, which are inserted into the request URL without proper encoding. This can result in unauthorized reads or writes with the privileges of the configured application. This is only exploitable if untrusted input is passed as a path variable without validation.
Workaround
This vulnerability can be mitigated by validating untrusted values before passing them to request classes, such as enforcing an allowlist pattern (e.g., ^[A-Za-z0-9_-]+$) for content IDs and schemes.