CVE-2026-54546
1 advisory.
npm/@tak-ps/cloudtak CVE-2026-54546: medium 5
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
Action: Upgrade @tak-ps/cloudtak to 13.22.1 or later.
npm i @tak-ps/cloudtak@13.22.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 13.22.1 | - |
Fixed versions
| 13.22.1 |
Sources
- osv: GHSA-vqrw-qphh-p34v
- https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v
- https://github.com/dfpc-coe/CloudTAK/pull/1513
- https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
- https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
- https://github.com/dfpc-coe/CloudTAK
- https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1
CVE-2026-54546 · published · modified · JSON