ntfy Arbitrary Code Execution Vulnerability

A vulnerability allowing remote code execution has been identified in ntfy versions prior to 2.21. The issue arises in the parseActions function, where an unanchored regular expression is used to validate web push endpoint URLs. This flaw enables attackers to craft URLs that bypass the allow-list and direct requests to arbitrary internal or external destinations.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where ntfy is running.

Remediation

Users can upgrade to ntfy version 2.22.0 or later to address this vulnerability.