Packagist/saloonphp/saloon CVE-2026-33182: medium, EPSS 0.52%
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL
Action: Upgrade saloonphp/saloon to 4.0.0 or later.
composer require saloonphp/saloon:4.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.0 | - |
Fixed versions
| 4.0.0 |
Sources
- osv: GHSA-c83f-3xp6-hfcp
- https://github.com/saloonphp/saloon/security/advisories/GHSA-c83f-3xp6-hfcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-33182
- https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4
- https://github.com/saloonphp/saloon
CVE-2026-33182 · published · modified · JSON