EyouCMS CVE-2026-116094

Exploitation targets the code path that invokes remote_file_to_local in application/function.php, i.e. functionality where EyouCMS fetches a remote file by URL; the PoC reference indicates the SSRF is reachable from the unauthenticated front end due to a missing validation/check on the requested target. Consistent with PR:N/UI:N, no authentication or user interaction is indicated as required. Limiting factors: impact is constrained to SSRF (coercing server-side requests) with no confirmed code execution or full data disclosure; the exact user-reachable feature and input that reach the function are not described in the available sources, and the affected range is bounded to versions 1.8.0 through 1.8.3. No fixed version is listed in the evidence, and the vendor provided no mitigation statement.

This is a moderate-severity server-side request forgery (CWE-918) in EyouCMS through 1.8.3. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, which aligns with the PoC reference title indicating an unauthenticated ('front-end') SSRF via a missing validation in remote_file_to_local. Impact is rated limited across confidentiality, integrity and availability (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N), consistent with an SSRF that can coerce the server into making requests but does not by itself grant full read of sensitive data or code execution. On the real-world-priority signals: this is NOT confirmed actively exploited - there is no CISA KEV listing and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified. A public PoC reference exists but is explicitly not verified as working exploit code, and the only maturity signal is the CVSS E:P (Proof-of-Concept) flag. The vuln.today decision label is 'this_month', not act_now or emergency. Net: the ease of reach (unauthenticated, network, low complexity) is the main driver of concern, but the limited technical impact, unverified PoC, absence of KEV/EPSS data, and the fact that the only intelligence source is VulDB keep this below top-tier urgency. A notable gap is that the vendor did not respond to disclosure, so no authoritative advisory or fix confirmation exists.

A remote attacker, without authentication, submits a crafted URL to the EyouCMS feature backed by the remote_file_to_local function, causing the server to fetch an attacker-chosen resource. Because validation of the target is missing, the attacker can point the server at internal/intranet addresses or cloud metadata endpoints to probe or reach otherwise unreachable services. A public PoC reference exists but is not verified as working exploit code, and the precise trigger beyond the missing SSRF check is not detailed in the available sources.