EUVD-2026-53015
GHSA-26jj-c4g2-h8m6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring admin credentials (PR:H); limited C/I/A impact consistent with internal resource access rather than code execution; no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.34 will fix this issue. It is recommended to upgrade the affected component.
AnalysisAI
Server-side request forgery in Rhymix CMS up to version 2.1.33 enables authenticated administrators to direct the server to fetch arbitrary internal or external URLs via the Data Import Module. The vulnerable entry point is the procImporterAdminCheckXmlFile function, where the filename argument is passed to server-side request logic without adequate validation, per CWE-918. Publicly available exploit code exists on GitHub (MCzhao2006/Rhymix-SSRF-Report), and this vulnerability is not currently listed in CISA KEV; EPSS data was not provided in source intelligence.
Technical ContextAI
Rhymix CMS is a PHP-based content management system maintained by Poesis (CPE: cpe:2.3:a:poesis:rhymix_cms:*:*:*:*:*:*:*:*). The vulnerable code resides in modules/importer/importer.admin.controller.php, specifically in the procImporterAdminCheckXmlFile function of the Data Import Module. CWE-918 (Server-Side Request Forgery) identifies the root cause class: attacker-controlled input - the filename argument - is used to construct or resolve a server-side HTTP/file request without proper allowlist filtering or URL scheme restrictions. This enables the CMS server to act as a proxy, potentially reaching internal network services, cloud instance metadata endpoints (e.g., http://169.254.169.254), or local file URIs, depending on the server environment's network topology and PHP configuration.
RemediationAI
Upgrade Rhymix CMS to version 2.1.34 immediately; the patched release is available directly from the vendor at https://rhymix.org/files/attach/releases/rhymix-2.1.34.zip and documented in the vendor advisory at https://rhymix.org/news/1948042. If immediate upgrade is not possible, restrict access to the CMS administrative backend to trusted IP ranges using web server-level allow/deny rules (nginx allow/deny or Apache Require ip), which reduces the window of exposure to admin-credentialed users on controlled networks - though this does not eliminate the underlying flaw. As an additional compensating control, consider disabling or removing the Data Import Module if the feature is not actively used, trading import functionality for a reduced attack surface. Network egress filtering on the application server (blocking outbound HTTP to RFC-1918 ranges and link-local addresses like 169.254.169.254) limits the practical reach of any SSRF exploitation even if the endpoint is triggered.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today