Is there a public PoC exploit available for CVE-2026-5126?

Yes, a public proof-of-concept exploit is available for CVE-2026-5126. Prioritise patching immediately. EPSS: 0.0%.

Rss Feed Parser CVE-2026-5126

Q: What is the CVSS score of CVE-2026-5126?

CVE-2026-5126 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17166 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-30 VulDB

GHSA-v2pm-mwvh-p9w7

SSRF Rss Feed Parser Sourcecodester

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

EUVD ID Assigned

Mar 30, 2026 - 18:15 euvd

EUVD-2026-17166

Analysis Generated

Mar 30, 2026 - 18:15 vuln.today

CVE Published

Mar 30, 2026 - 18:00 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in SourceCodester RSS Feed Parser 1.0. Affected by this issue is the function file_get_contents. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

Server-side request forgery in SourceCodester RSS Feed Parser 1.0 via the file_get_contents function allows authenticated remote attackers to perform arbitrary HTTP requests from the vulnerable server. The vulnerability has a CVSS score of 5.3 with low impact across confidentiality, integrity, and availability, and publicly available exploit code exists.

Technical ContextAI

The vulnerability resides in improper input validation of the file_get_contents function within SourceCodester RSS Feed Parser 1.0 (CPE: cpe:2.3:a:sourcecodester:rss_feed_parser:*:*:*:*:*:*:*:*). This is a classic CWE-918 Server-Side Request Forgery (SSRF) flaw where user-controlled input is passed to a function that fetches remote content without adequate URL validation or allowlisting. The file_get_contents PHP function, when given an attacker-controlled URL, will make HTTP requests from the server's perspective, potentially accessing internal resources, cloud metadata services, or internal APIs that would otherwise be unreachable from external sources. The blind SSRF nature (as referenced in the public exploit) suggests the attacker may not receive direct response data but can infer results through side-channel observations or time-based techniques.

RemediationAI

Upgrade SourceCodester RSS Feed Parser to a patched version released by the vendor; no specific fixed version number is confirmed in available data. Immediate workarounds include implementing strict URL validation and allowlisting for any user-controlled input passed to file_get_contents or similar remote content fetching functions, disabling support for file:// and gopher:// URL schemes, and restricting outbound HTTP requests from the application to known legitimate external hosts. Network-level controls such as firewall rules preventing the web application from reaching internal resources or cloud metadata endpoints (e.g., 169.254.169.254) can further mitigate exploitability. Check the vendor advisory at https://www.sourcecodester.com/ for patched version availability and apply updates when available.