Answer in brief
CVE-2026-19927 records a Unknown severity vulnerability in OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery. The current sources do not mark it as known exploited. The current feed maps n/a/OpenBoxes (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-19927 records a Unknown severity vulnerability in OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery. The current sources do not mark it as known exploited. The current feed maps n/a/OpenBoxes (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n/a/OpenBoxes (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n/a/OpenBoxesgeneric | 0.9.0 || 0.9.1 || 0.9.2 || 0.9.3 || 0.9.4 || 0.9.5 || 0.9.6 || 0.9.7 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n/a/OpenBoxes (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n/a/OpenBoxesgeneric | 0.9.0 || 0.9.1 || 0.9.2 || 0.9.3 || 0.9.4 || 0.9.5 || 0.9.6 || 0.9.7 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.
Quoted source text, attributed separately from HOL analysis.