EUVD-2026-83991
GHSA-qqh7-w389-w2hg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CuteNews panel
-
DeliveryOpen Media Manager 'Upload by URL'
-
ExploitSubmit crafted internal/metadata URL
-
ExecutionServer-side fetch via upload_from_inet
-
ImpactRetrieve stored response for internal data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the Media Manager's 'Upload by URL' function (upload_from_inet in core/modules/media.php) in CuteNews 2.1.2 and supplying an attacker-controlled URL that the server then fetches. In practice this Media Manager panel is a post-login feature, so a valid account is the primary prerequisite even though the published CVSS lists PR:N - defenders should confirm whether the endpoint is reachable pre-auth. Effective impact also depends on internal network reachability from the server (internal services, cloud metadata endpoints) and on whether the fetched response is returned/stored where the attacker can read it, versus a blind SSRF that only permits probing. |
| Impact | This is a high-CVSS-but-modest-real-risk issue. The NVD/mitre vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1) rates it near-critical, but two components look inflated: PR:N contradicts the fact that CuteNews' Media Manager 'Upload by URL' is a logged-in panel feature, and I:H is unusual for a classic SSRF whose impact is primarily read/probe (C-side), not integrity. Corroborating signals point to lower real-world urgency: EPSS is only 0.15% (5th percentile), there is no CISA KEV listing, and SSVC decision is Exploitation: none (though Automatable: yes and Technical Impact: total). So while an SSRF here is genuinely useful for internal-network reconnaissance and metadata/service access, the combination of a required account, an obscure product footprint, and no evidence of exploitation makes this a moderate priority rather than an emergency. Note the CVSS/description tension explicitly: verify whether upload_from_inet is reachable pre-authentication before treating PR:N as accurate. |
| Exploit ScenarioDerived | An attacker with access to the CuteNews admin/user panel opens the Media Manager, uses 'Upload by URL', and supplies an internal or cloud-metadata URL (e.g., http://169.254.169.254/ or an internal service). The server (upload_from_inet in core/modules/media.php) fetches that URL and stores/returns the response, letting the attacker probe internal services and exfiltrate their content. A vulnerability-disclosure repository exists but no weaponized public exploit code is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Server-side request forgery in CuteNews 2.1.2 (core/modules/media.php, the Media Manager 'Upload by URL' handler upload_from_inet) lets an attacker submit a crafted URL that the PHP backend fetches on the attacker's behalf, exposing internal-only services and cloud instance metadata endpoints to server-side retrieval. Our independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N rather than the published 9.1, because the Media Manager panel is a post-login feature, so a valid account is the practical prerequisite even though the published vector lists PR:N; realized impact further depends on internal network reachability and on whether the fetched response is returned or stored where the attacker can read it (blind SSRF only allows probing). No public exploit code or KEV-listed active exploitation was identified at time of analysis, and EPSS is very low at 0.15% (5th percentile), so this is a high-CVSS-but-modest-real-risk issue.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version number is present in the supplied data, so remediation must be compensating-control driven. The most direct measure is to remove or disable the 'Upload by URL' capability in core/modules/media.php - unset/disable the upload_from_inet action or strip it from the module dispatch so the server can no longer fetch attacker-supplied URLs; the trade-off is loss of legitimate remote-import functionality, and any code edit will be overwritten by a future upstream update, so track the project at https://github.com/CuteNews/cutenews-2.0 for an official fix. Restrict access to the Media Manager and the administrative panel behind authentication plus network-level controls (IP allowlisting, VPN, or a reverse-proxy rule) and, crucially, verify whether the endpoint is reachable without authentication, since the published CVSS lists PR:N while our assessment assumes a post-login feature - if pre-auth reachability is confirmed, treat this as an urgent exposure. Because SSRF harm comes from server-side egress, apply an outbound egress policy on the CuteNews host that denies traffic to loopback, RFC1918 ranges, and the link-local metadata address 169.254.169.254, and enforce cloud instance metadata protection (IMDSv2 requirement or hop-limit 1 on AWS); the trade-off is that legitimate outbound integrations from the same host will break unless explicitly allowlisted. If PHP-level hardening is feasible, disable allow_url_fopen and restrict cURL protocols for the web process so that URL-based fetches fail outright, but note that same-host cURL usage elsewhere in the application may stop working. Finally, monitor for SSRF indicators (outbound requests originating from the web tier to internal or metadata addresses) using the disclosure reference at https://github.com/UmbraDeorum/cutenews-2.0-CVEs-2026-Disclosure and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-36469.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CuteNews is a PHP-based flat-file news/blog CMS, and the vulnerability lives in its Media Manager module at core/modules/media.php. The 'Upload by URL' feature (upload_from_inet) accepts a user-supplied URL and has the server retrieve that remote resource, a pattern classified as CWE-918 (Server-Side Request Forgery) when the destination host, scheme, and resulting connection are not constrained by an allowlist or a private/link-local address block. In a PHP implementation this typically means file_get_contents, fopen with allow_url_fopen, or a cURL handle created without CURLOPT_PROTOCOLS restrictions and without re-validating the resolved IP after DNS resolution, which additionally permits DNS-rebinding and HTTP-redirect bypasses of naive hostname filters. Concrete attacker targets are loopback and RFC1918 services and the cloud metadata endpoints at 169.254.169.254, which on non-hardened instances can yield IAM credentials. Notably, no formal NVD CPE assignment exists for this issue (the supplied CPE string is a placeholder, cpe:2.3:a:n/a:n/a) and EUVD lists affected versions as 'n/a', so version identification must rely on the project repository and disclosure references rather than CPE matching; the accompanying tags (PHP, SSRF) align with that picture. For comparison, CISA's SSVC decision framework marks this Automatable: yes with Technical Impact: total, which is a broader impact statement than our scoped assessment of confidentiality-only loss (C:H/I:N/A:N).
Know when Cutenews gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Media Manager 'Upload by URL' is an authenticated panel feature (PR:L, not PR:N); SSRF here reads internal resources (C:H) but does not itself modify data or affect availability (I:N/A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
Executive ViewAI
CuteNews 2.1.2, used for news publishing, contains a server-side request forgery flaw in its Media Manager 'Upload by URL' feature that allows a logged-in user to make the server fetch arbitrary URLs, potentially reaching internal-only systems and cloud instance metadata endpoints. The practical exposure is limited because a valid account is required and no public exploit code or active exploitation has been observed, but a successful attack against a cloud-hosted instance could expose credentials or internal services outside the publishing team's control. Leadership should care because remediation depends on network isolation and access tightening rather than a vendor patch, which is not yet available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Media Manager access to trusted authenticated accounts, enforce egress filtering and block requests to link-local/private ranges and cloud metadata endpoints (169.254.169.254), enforce IMDSv2, apply WAF/reverse-proxy URL validation on the 'Upload by URL' feature, disable the upload_from_inet functionality if not required, and monitor for anomalous outbound connections until an upstream fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
An issue was discovered in CutePHP CuteNews 2.1.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploi
CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors. Rated high s
Reflected cross-site scripting in CuteNews 2.1.2 allows remote unauthenticated attackers to execute arbitrary JavaScript
Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via
PHP object injection in CuteNews 2.1.2 allows remote attackers to overwrite internal request variables - including __ref
Reflected cross-site scripting (XSS) in CuteNews 2.1.2 allows the value of the HTTP Referer header to be copied, unescap
Reflected cross-site scripting (XSS) in CuteNews 2.1.2 allows an unauthenticated remote attacker to inject a javascript:
Exploit-DB