Answer in brief
CVE-2026-55421 records a Medium severity (CVSS 6.8) vulnerability in Open edX Platform: SSRF in Studio Video Download Endpoint. The current sources do not mark it as known exploited. The current feed maps openedx/openedx-platform (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps openedx/openedx-platform (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| openedx/openedx-platformgeneric | <00b7c3ce418b487c5696b064fc5033594b045e75 | 00b7c3ce418b487c5696b064fc5033594b045e75 |
Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 2, 2026
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.
Quoted source text, attributed separately from HOL analysis.