RhaPHP CVE-2026-116256

Exploitation requires that the RhaPHP Mp Module media-proxy (the image function in application/mp/controller/Show.php) be reachable and that the attacker can control the 'url' argument it fetches; per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication or user interaction is required. The description does not state additional configuration prerequisites, so the specific conditions beyond reaching this endpoint are not described in the available sources. Limiting factors: the module must be deployed and network-accessible to the attacker, and the measured impact is LOW across confidentiality/integrity/availability with no scope change, so the SSRF's practical value depends on what internal targets are reachable from the server. Because RhaPHP is a rolling release, there are no affected/fixed version numbers to scope exposure.

This is a server-side request forgery (CWE-918) in the RhaPHP Mp Module media proxy, reachable remotely. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-based, low-complexity, unauthenticated exploitation with no user interaction, which is consistent with an SSRF reachable through an attacker-controlled 'url' argument. However, the impact metrics are all LOW (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), capping the score at 6.9 - this is a medium-severity issue, not a critical one, because the vendor assessed only limited confidentiality/integrity/availability impact and no subsequent-system (scope) impact. The input carries no EPSS probability and no CISA KEV listing, so there is no signal of widespread or confirmed active exploitation; the vuln.today priority is 'this_month', a moderate-urgency label rather than act_now/emergency. A public PoC reference is listed (a GitHub gist) but is not verified as working exploit code, so exploitability in practice is plausible but not demonstrated. The E:P (Proof-of-Concept) exploit-maturity value in the vendor vector is consistent with that unverified PoC. Net: a genuine, remotely reachable SSRF worth remediating within a normal patch cycle, but the LOW impact metrics, absence of EPSS/KEV, and unverified PoC argue against treating it as an emergency. Key gap: no EPSS score is provided, so quantitative exploitation probability cannot be stated.

A remote, unauthenticated attacker sends a request to the RhaPHP Mp Module media-proxy endpoint (the image function in application/mp/controller/Show.php) with a crafted value in the 'url' parameter pointing at an internal address or service. The server fetches the attacker-supplied URL, allowing the attacker to probe internal hosts, reach cloud metadata endpoints, or access otherwise-firewalled services. A public PoC reference exists (a GitHub gist); it is not verified as working exploit code.