EUVD-2026-77109
GHSA-96w3-w353-39h8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
S:C and C:H reflect unrestricted cross-document read of any uploaded file by SRL; A:L covers deletion via the update path; PR:L confirmed by authentication requirement.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
AnalysisAI
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user session on a Rhymix CMS instance before version 2.1.31 (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Rhymix 2.1.31 or later; this is the only confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Rhymix CMS deployments in your environment and document their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today