CVE-2026-42140 | defend.network

What is CVE-2026-42140?

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue has been patched in version 2.4.1.

CVSS4.4 NVD 3.1

SeverityMEDIUM

ExploitationNo exploitation reported

EPSS<1% · P5

Triage statusNo Known Exploit

ActionSchedule for next cycle

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD published2026-05-04

NVD last modified2026-06-17

Timeline

2026-05-04Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

See advisory

Remediation Steps

Upgrade Ruggedcom Rox to version 2.17.1 or later to patch input validation and third-party vulnerabilities
Disable Scheduler functionality until validated after patching
Review Scheduler command history logs for evidence of arbitrary command injection attempts
Restrict Ruggedcom Rox administrative access to authenticated users only via strong MFA
Conduct operational validation of all critical network routing functions post-upgrade

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of May 2026 (May 18 – 24)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.