---
id: 5211
title: "Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle"
cvss: 9.3
severity: critical
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-titiler-lfi"
published_at: "2025-07-28T12:00:00Z"
tags: ["vulnerability-research", "ssrf", "exfiltration", "file-read", "titiler", "geospatial"]
phying_url: "https://phying.com/item/5211"
lang: en
---

# Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle

## Summary

Details how XBOW escalated a blind SSRF in TiTiler into a full arbitrary file read via byte-by-byte exfiltration in a 48-step chain, from OpenAPI recon to the final oracle.

## Intelligence Metadata

- **Sources:** xbow.com
- **CVSS:** 9.3
- **Published:** 2025-07-28T12:00:00Z
- **Original:** https://xbow.com/blog/xbow-titiler-lfi
- **Phying News:** https://phying.com/item/5211