{"action":"Upgrade @tak-ps/cloudtak to 13.22.1 or later.","affected":[{"fixed":"13.22.1","introduced":"0"}],"component":"@tak-ps/cloudtak","cve_ids":["CVE-2026-54546"],"ecosystem":"npm","epss":0.00372,"exploited":false,"fixed_versions":["13.22.1"],"ghsa_id":"GHSA-vqrw-qphh-p34v","id":"tcs_01M5KGCQN70WPCY17MQQE126PV","modified_at":"2026-09-17T17:15:04.646590865Z","published_at":"2026-07-17T19:02:37Z","references":["https://osv.dev/vulnerability/GHSA-vqrw-qphh-p34v","https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v","https://github.com/dfpc-coe/CloudTAK/pull/1513","https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c","https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf","https://github.com/dfpc-coe/CloudTAK","https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-vqrw-qphh-p34v","url":"https://osv.dev/vulnerability/GHSA-vqrw-qphh-p34v"}],"summary":"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard"}