Is there a public PoC exploit available for CVE-2026-6983?

Yes, a public proof-of-concept exploit is available for CVE-2026-6983. Prioritise patching immediately. EPSS: 0.0%.

Pagekit CVE-2026-6983

Q: What is the CVSS score of CVE-2026-6983?

CVE-2026-6983 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25659 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-25 VulDB

PHP SSRF N A Pagekit

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 25, 2026 - 16:22 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 16:00 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 15:45 euvd

EUVD-2026-25659

Analysis Generated

Apr 25, 2026 - 15:45 vuln.today

CVE Published

Apr 25, 2026 - 15:15 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in Pagekit up to version 1.0.18 allows authenticated high-privilege administrators to manipulate the url parameter in the /index.php/admin/system/update/download endpoint, enabling them to force the server to make arbitrary HTTP requests to internal or external systems. Publicly available exploit code exists, and the vendor did not respond to early disclosure efforts.

Technical ContextAI

Pagekit is a PHP-based content management system. The vulnerability resides in the administrative system update download functionality, which accepts a user-supplied url parameter without proper validation or sanitization. The underlying issue is CWE-918 (Server-Side Request Forgery), where insufficient input validation allows attackers to control the destination of server-initiated HTTP requests. This permits attackers to probe internal network services, interact with cloud metadata endpoints, or pivot to internal systems that are only accessible from the server itself.

RemediationAI

Upgrade Pagekit to a version after 1.0.18 if available; if no newer release exists, apply strict network-level access controls to the Pagekit admin interface. Restrict access to /index.php/admin/ endpoints to trusted IP addresses only, using firewall rules or web application firewall (WAF) rules; this prevents unauthorized admin access even if credentials are compromised. Disable the system update functionality entirely in production environments via configuration or by removing the /index.php/admin/system/update/download endpoint if not required. Implement egress filtering on the Pagekit server to block outbound HTTP/HTTPS requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8) and cloud metadata endpoints (169.254.169.254). Monitor access logs for unusual requests to the update/download endpoint with suspicious url parameters. Audit admin accounts and rotate credentials if compromise is suspected.