CVE-2026-48053

[CVE catalog]

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.

Severity

Medium · CVSS 5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Published

Jul 13, 2026, 3:46:16 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.38% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "kolibri",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.19.4"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "0.19.4",
      "provider_record_id": "PYSEC-2026-2554"
    }
  ]
}