SveltyCMS EUVD-2026-82980

Requires an authenticated low-privileged account (CVSS PR:L) on a SveltyCMS 0.0.6 instance and access to the File Upload Endpoint at /mediagallery/upload-media, which fetches an attacker-supplied remote media/importer URL server-side. Exploitation is limited by: the need for valid credentials (not pre-auth), low resulting impact (VC:L/VI:L/VA:L, no scope change), and the requirement that the target be a reachable running SveltyCMS instance with the remote-media fetch feature exercised. No user interaction is needed (UI:N).

Multi-source signals point to a real-but-modest issue, not a top priority. The vendor (VulDB) CVSS 4.0 base score is 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L - network-reachable and low-complexity, but requiring at least low-privileged authentication (PR:L) and yielding only low impact across confidentiality, integrity and availability. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so exploitation status is: no public exploit identified at time of analysis. The E:X (exploit maturity Not Defined) in the vendor vector reinforces that maturity is unknown rather than proven. This is a classic CWE-918 SSRF in a file-upload/remote-media path, and the low VC/VI/VA and PR:L requirement mean it is a defense-in-depth SSRF rather than a wormable pre-auth RCE. Notable data gap: the provided GitHub commit diff only shows changes to AGENTS.md (security guidance) and bun.lock (dependency bumps) - it does NOT contain the actual endpoint code fix (e.g. validateEgressUrl/safeFetch enforcement on /mediagallery/upload-media), so the precise remediated code path cannot be independently confirmed from the shown hunk. Overall: legitimate to patch, but low real-world urgency given the authentication requirement, low impact, absent exploitation signals, and a very early-stage (0.0.6) niche product.

A low-privileged authenticated user of a SveltyCMS 0.0.6 instance submits a crafted request to the /mediagallery/upload-media endpoint supplying an attacker-controlled remote media/import URL, causing the server to fetch it. By pointing the URL at internal services, localhost, or cloud metadata endpoints (169.254.169.254), the attacker coerces the server into making outbound requests to otherwise-unreachable internal resources. No public proof-of-concept is provided; the CVSS vector indicates remote, low-complexity exploitation but requires valid low-privileged credentials.