CVE-2026-85380 in cms
Summary
by MITRE • 09/04/2026
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source[] causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The identified vulnerability resides within the light0011 content management system, specifically targeting the UEditor component which is widely used for rich text editing functionalities on web platforms. The flaw is located in the catchimage function found in the file Public/ueditor/php/controller.php. This particular code segment handles image uploads and processing, a common feature in modern CMS environments that allows users to insert images directly into content fields. However, the implementation fails to adequately validate or sanitize input data before passing it to underlying system functions responsible for fetching remote resources.
The core technical flaw is classified as Server-Side Request Forgery, which corresponds to CWE-918 in the Common Weakness Enumeration standard. This vulnerability arises because the application accepts a user-controlled parameter named source[] without sufficient restrictions on the allowed protocols or destination hosts. An attacker can manipulate this argument to instruct the server to make HTTP requests to arbitrary internal or external addresses. By crafting specific payloads, an adversary can force the vulnerable server to act as a proxy, initiating connections to services that are otherwise inaccessible from the public internet due to firewall rules or network segmentation policies.
The operational impact of this vulnerability is significant because it enables remote exploitation without requiring authentication in many configurations, although some setups may require user access depending on CMS permissions. The ability to perform SSRF allows attackers to probe internal networks, potentially discovering sensitive services such as database management interfaces, administrative panels, or cloud metadata endpoints that provide instance credentials and configuration details. This can lead to unauthorized data access, lateral movement within the network infrastructure, and in severe cases, complete compromise of the underlying server environment if combined with other vulnerabilities like deserialization flaws often found in internal APIs.
The exploit for this vulnerability has been made publicly available, which significantly lowers the barrier to entry for malicious actors. This availability increases the likelihood of automated scanning and opportunistic attacks against systems running unpatched versions of light0011 CMS or its associated UEditor component. Since the project utilizes a rolling release model, there are no discrete version numbers that can be easily referenced in patch management tools. This continuous delivery approach means administrators must ensure they are running the absolute latest codebase to mitigate known issues, as specific fixed releases cannot be identified by traditional versioning schemes.
Mitigation strategies should focus on immediate remediation and defensive configuration changes. The most effective solution is to apply the latest available updates from the light0011 project repository once a fix is confirmed or implemented by the maintainers. In the interim, network-level controls can help mitigate risk. Implementing strict egress filtering rules that restrict outbound connections from web servers to only necessary external domains and blocking access to private IP ranges such as 192.168.x.x, 10.x.x.x, and 172.16-31.x.x is critical. Additionally, input validation should be enforced at the application level by whitelisting allowed protocols (e.g., http/https only) and validating hostnames against a list of permitted domains before processing image requests.
From an offensive security perspective, this vulnerability aligns with ATT&CK technique T1598, specifically Phishing for Information within Intra-Organizational Networks or T1071 Application Layer Protocol if used to exfiltrate data via HTTP/S channels. Security teams should monitor web server logs for unusual outbound connection patterns originating from the UEditor endpoints and investigate any requests targeting internal IP addresses or non-standard ports. Given that the project maintainers have not yet responded to early reports, organizations relying on this software must treat it as high-risk until a verified patch is released and actively test their network perimeter defenses against SSRF exploitation attempts.