CVE-2026-15974 | Vulnetix

CVE-2026-15974 PUBLISHED CVSS 6.5 MEDIUM

Reported by certcc · Published July 30, 2026

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
SGLang	SGLang	0
SGLang	SGLang	0, 0

Timeline

Jul 30, 2026 CVE Published
Jul 31, 2026 Coalition ESS Score
Jul 31, 2026 CVE Updated
Aug 3, 2026 Security Advisory
Aug 7, 2026 EPSS Score

References

Open in Interactive Console →