{"action":"Upgrade graphite-web to 1.1.6 or later.","affected":[{"fixed":"1.1.6","introduced":"0"}],"component":"graphite-web","cve_ids":["CVE-2017-18638"],"ecosystem":"PyPI","epss":0.15301,"exploited":false,"fixed_versions":["1.1.6"],"ghsa_id":"GHSA-vfj6-275q-4pvm","id":"tcs_01M5KG01MHDVJGFYTS1VCR7CGG","modified_at":"2026-07-08T06:00:25.683795834Z","published_at":"2019-10-25T13:55:20Z","references":["https://osv.dev/vulnerability/GHSA-vfj6-275q-4pvm","https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm","https://nvd.nist.gov/vuln/detail/CVE-2017-18638","https://github.com/graphite-project/graphite-web/issues/2008","https://github.com/graphite-project/graphite-web/pull/2499","https://github.com/graphite-project/graphite-web/commit/71726a0e41a5263f49b973a7b856505a5b931c1f","https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf","https://github.com/graphite-project/graphite-web","https://github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2019-151.yaml","https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html","https://www.youtube.com/watch?v=ds4Gp4xoaeA"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vfj6-275q-4pvm","url":"https://osv.dev/vulnerability/GHSA-vfj6-275q-4pvm"}],"summary":"graphite.composer.views.send_email vulnerable to SSRF"}