CVE-2026-116094

Received Received - Intake

Server-Side Request Forgery in EyouCMS

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-25

Last Modified

2026-10-25

Generated

2026-10-26

AI Q&A

2026-10-26

EPSS Evaluated

N/A

NVD

CVE-2026-116094

EUVD

EUVD-2026-109573

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	EyouCMS	1.8.0
n/a	EyouCMS	1.8.1
n/a	EyouCMS	1.8.2
n/a	EyouCMS	1.8.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability exists in EyouCMS versions up to 1.8.3, specifically in the remote_file_to_local function of application/function.php. It allows server-side request forgery (SSRF) attacks due to improper input validation. An attacker can manipulate the function to make unauthorized requests from the server, potentially accessing internal systems or data.

Impact Analysis

This vulnerability can allow remote attackers to perform SSRF attacks, which may lead to unauthorized access to internal resources, data exfiltration, or further network compromise. The impact includes potential exposure of sensitive information or internal services.

Mitigation Strategies

Immediately update EyouCMS to the latest version beyond 1.8.3 to address the server-side request forgery vulnerability in the remote_file_to_local function. If an update is unavailable, consider disabling the affected function or restricting network access to the vulnerable component.

Hi! I’m here to help you understand CVE-2026-116094. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70