Rhymix
Monthly
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.