ProcessWire CMS up to 3.0.255 Add Module module download server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in ProcessWire CMS up to 3.0.255. The impacted element is an unknown function of the component Add Module. Such manipulation of the argument module download leads to server-side request forgery. This vulnerability is listed as CVE-2026-40500. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in ProcessWire CMS up to 3.0.255. It has been rated as critical. Affected by this issue is an unknown functionality of the component Add Module. The manipulation of the argument module download with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

The weakness was presented by Piyush Kumar Shukla. The advisory is shared for download at gist.github.com. This vulnerability is handled as CVE-2026-40500 since 04/13/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• ProcessWire

Name

• CMS

Version

• 3.0.255

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion