CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54546 · Microsoft / collected KEV context

EUVD-2026-82331

GHSA-vqrw-qphh-p34v

cve-program · CVE-2026-54546

• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v
• https://github.com/dfpc-coe/CloudTAK/pull/1513
• https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
• https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
• https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1

euvd · EUVD-2026-82331

• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v
• https://github.com/dfpc-coe/CloudTAK/pull/1513
• https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
• https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
• https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1

nvd · CVE-2026-54546

• https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
• https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
• https://github.com/dfpc-coe/CloudTAK/pull/1513
• https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1
• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v

osv · GHSA-vqrw-qphh-p34v

• https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v
• https://github.com/dfpc-coe/CloudTAK/pull/1513
• https://github.com/dfpc-coe/CloudTAK/commit/1e0f6e65977c86fbc0aa15e308c43cbcaee23a7c
• https://github.com/dfpc-coe/CloudTAK/commit/556b35632877802c7e9c818db44aef7a2c3abebf
• https://github.com/dfpc-coe/CloudTAK
• https://github.com/dfpc-coe/CloudTAK/releases/tag/v13.22.1

No related operational record is retained in the current change model.