What is the CVSS score of CVE-2026-30637?

CVE-2026-30637 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-30637?

Organizations using the AnnounContent of the /admin/read.php in OTCMS face notable risk from CVE-2026-30637, a server-side request forgery vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-30637?

Within 7 days: Identify all affected systems running the AnnounContent of the /admin/read.php in OTCMS and apply vendor patches promptly. Implement egress filtering and URL validation for server-side requests.

PHP CVE-2026-30637

EUVD-2026-16642 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-27 mitre

SSRF PHP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 14:45 euvd

EUVD-2026-16642

Analysis Generated

Mar 27, 2026 - 14:45 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to internal services or any remote server

AnalysisAI

OTCMS versions 7.66 and earlier contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /admin/read.php endpoint's AnnounContent parameter, enabling remote attackers to craft arbitrary HTTP requests targeting internal services or external systems without requiring credentials. The vulnerability is documented in public security research; however, no CVSS score, EPSS probability, or confirmed active exploitation status is available from CISA KEV data at this time.

Technical ContextAI

The vulnerability exploits improper input validation in a PHP-based content management system (OTCMS). The /admin/read.php script fails to sanitize or validate URLs submitted via the AnnounContent parameter before making server-side HTTP requests, violating CWE principles for input validation and URL handling. SSRF flaws allow attackers to abuse the application server's network access to reach internal services (databases, administrative interfaces, cloud metadata endpoints) or to perform reconnaissance and lateral movement. The absence of authentication requirements (as stated in the description) indicates the vulnerable endpoint is either publicly accessible or accessible with minimal privilege, significantly broadening the attack surface. CPE data is marked as N/A, suggesting the vulnerability has not been formally registered with a stable CPE identifier, which may indicate emerging or community-reported status.

RemediationAI

Immediate action: verify your OTCMS version and confirm whether version 7.67 or later is available from the vendor. If a patched version exists, upgrade immediately. If no patch is available, implement compensating controls: (1) restrict network access to /admin/read.php via firewall or Web Application Firewall (WAF) rules, limiting requests to trusted internal IP ranges only; (2) disable or remove the /admin/read.php endpoint if not actively used; (3) implement input validation and URL filtering within a reverse proxy or WAF to reject requests containing suspicious URL schemes (file://, gopher://, internal IP ranges) in the AnnounContent parameter; (4) segment the application server's network access so it cannot reach sensitive internal services (databases, metadata endpoints, administrative interfaces). Contact the OTCMS vendor or project maintainers directly via their official channels for patch status and timeline, as vendor advisory information is not available in current intelligence sources.