docs(website): add CVE-2026-107460 security advisory

website/blog/2026-10-14-cve-2026-107460.md

@@ -0,0 +1,56 @@
+---
+title: "CVE-2026-107460 - Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding"
+description: Security advisory for CVE-2026-107460.
+tags: [announcement, security, CVE-2026-107460]
+---
+
+<!--
+- Licensed to the Apache Software Foundation (ASF) under one or more
+- contributor license agreements.  See the NOTICE file distributed with
+- this work for additional information regarding copyright ownership.
+- The ASF licenses this file to You under the Apache License, Version 2.0
+- (the "License"); you may not use this file except in compliance with
+- the License.  You may obtain a copy of the License at
+-
+-   http://www.apache.org/licenses/LICENSE-2.0
+-
+- Unless required by applicable law or agreed to in writing, software
+- distributed under the License is distributed on an "AS IS" BASIS,
+- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- See the License for the specific language governing permissions and
+- limitations under the License.
+-->
+
+Security advisory for **CVE-2026-107460** regarding Server-Side Request Forgery (SSRF) in Apache Fesod (Incubating).
+
+<!--truncate-->
+
+## Description
+
+Server-Side Request Forgery (SSRF) protection in the `UrlImageConverter` component of Apache Fesod (Incubating) `fesod-sheet` 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again.
+
+An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. **CVE-2026-49328** covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating.
+
+Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
+
+## Affected Modules and Versions
+
+Fesod Spreadsheet (`fesod-sheet`):
+
+- 2.0.2-incubating
+
+## Mitigation
+
+Users of affected versions should upgrade to the corresponding fixed version.
+
+| Affected version(s) | Fix version      |
+|---------------------|------------------|
+| 2.0.2-incubating    | 2.1.0-incubating |
+
+## References
+
+- [https://github.com/apache/fesod/pull/1035](https://github.com/apache/fesod/pull/1035)
+- [https://github.com/apache/fesod/releases/tag/2.1.0-incubating](https://github.com/apache/fesod/releases/tag/2.1.0-incubating)
+- [https://cve.org/CVERecord?id=CVE-2026-49328](https://cve.org/CVERecord?id=CVE-2026-49328)
+- [https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83](https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83)
+- [https://www.cve.org/CVERecord?id=CVE-2026-107460](https://www.cve.org/CVERecord?id=CVE-2026-107460)

website/i18n/zh-cn/docusaurus-plugin-content-blog/2026-10-14-cve-2026-107460.md

@@ -0,0 +1,56 @@
+---
+title: "CVE-2026-107460 - Apache Fesod (Incubating)：通过 DNS 重绑定绕过 UrlImageConverter SSRF 防护"
+description: 关于 CVE-2026-107460 的安全公告.
+tags: [announcement, security, CVE-2026-107460]
+---
+
+<!--
+- Licensed to the Apache Software Foundation (ASF) under one or more
+- contributor license agreements.  See the NOTICE file distributed with
+- this work for additional information regarding copyright ownership.
+- The ASF licenses this file to You under the Apache License, Version 2.0
+- (the "License"); you may not use this file except in compliance with
+- the License.  You may obtain a copy of the License at
+-
+-   http://www.apache.org/licenses/LICENSE-2.0
+-
+- Unless required by applicable law or agreed to in writing, software
+- distributed under the License is distributed on an "AS IS" BASIS,
+- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- See the License for the specific language governing permissions and
+- limitations under the License.
+-->
+
+关于 Apache Fesod (Incubating) 中服务端请求伪造（SSRF）漏洞 **CVE-2026-107460** 的安全公告。
+
+<!--truncate-->
+
+## 漏洞描述
+
+Apache Fesod (Incubating) `fesod-sheet` 2.0.2-incubating 版本中，`UrlImageConverter` 组件的服务端请求伪造（SSRF）防护机制可能被 DNS 重绑定绕过。当应用程序接收由攻击者控制的图片 URL 用于写入电子表格时，该转换器会先检查主机名解析出的 IP 地址，随后会建立一个新的独立连接，而该连接可能会再次对主机名进行解析。
+
+控制该 URL 主机名 DNS 响应的攻击者，可在安全校验通过后使连接访问到受限制的内部或敏感地址。**CVE-2026-49328** 涵盖了 2.0.2-incubating 之前版本中的 SSRF 问题；本次漏洞则是针对 2.0.2-incubating 中防护措施的 DNS 重绑定绕过。
+
+Apache Fesod (Incubating) 2.1.0-incubating 通过默认禁用远程 URL 图片抓取，并在启用该功能时强制要求配置精确的主机名白名单，从而解决了所报告的默认抓取场景问题。建议用户升级至 2.1.0-incubating。启用了远程 URL 图片抓取功能的应用程序，应仅将 DNS 和 HTTP 服务均值得信赖的主机名加入白名单。
+
+## 受影响的模块与版本
+
+Fesod Spreadsheet (`fesod-sheet`):
+
+- 2.0.2-incubating
+
+## 修复建议
+
+建议受影响版本的用户尽快升级到对应的修复版本。
+
+| 受影响版本       | 修复版本         |
+|------------------|------------------|
+| 2.0.2-incubating | 2.1.0-incubating |
+
+## 参考链接
+
+- [https://github.com/apache/fesod/pull/1035](https://github.com/apache/fesod/pull/1035)
+- [https://github.com/apache/fesod/releases/tag/2.1.0-incubating](https://github.com/apache/fesod/releases/tag/2.1.0-incubating)
+- [https://cve.org/CVERecord?id=CVE-2026-49328](https://cve.org/CVERecord?id=CVE-2026-49328)
+- [https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83](https://lists.apache.org/thread/oh706yhm32hmw8vx4kh1948h952pfr83)
+- [https://www.cve.org/CVERecord?id=CVE-2026-107460](https://www.cve.org/CVERecord?id=CVE-2026-107460)