GREENmod named pipe flaw enables SSRF
A misconfigured named pipe ACL in GREENmod lets attackers upload files processed with service privileges, enabling SSRF via SMB/WebDAV; fixed in 2.8.33.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of a vulnerability in GREENmod, software that uses named pipes for inter-process communication between plugins, its web portal, and a system service. Incorrectly configured access control lists on these pipes allow an unauthenticated or low-privileged attacker to write directly to the pipe stream and submit arbitrary XML or JSON content, which is then processed with the privileges of the account running the service.
Exploitation of this flaw enables Server-Side Request Forgery against any Windows host running the GREENmod agent that supports SMB or WebDAV communication, potentially allowing an attacker to coerce the affected service into making requests or connections to internal or attacker-controlled resources. The vendor has resolved the issue in version 2.8.33, and organizations running GREENmod should upgrade promptly. The report credits researcher Marcin Ressel for responsibly disclosing the flaw through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-5131
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs