Server-Side Request Forgery in Poesis Rhymix CMS

Executive Summary

CVE-2026-18856 is a Server-Side Request Forgery (SSRF) vulnerability in Poesis Rhymix CMS versions up to 2.1.33. It exists in the function procImporterAdminCheckXmlFile within the Data Import Module. The flaw allows an attacker with administrator privileges to manipulate the filename parameter, causing the server to make unauthorized HTTP requests to internal or external systems without validation.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-18856, check if your Rhymix CMS version is 2.1.33 or earlier. Inspect the modules/importer/importer.admin.controller.php file for the procImporterAdminCheckXmlFile function. Verify if the $filename parameter is passed directly to @fopen() without validation. Use commands like grep to search for vulnerable patterns in the codebase.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform internal network discovery, scan open ports, or access sensitive cloud metadata. It may also enable blind file existence detection by comparing response times. The impact requires administrator access but could lead to further exploitation if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized data exposure or access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding protected health information. Organizations must address it to maintain compliance with data security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Rhymix CMS to version 2.1.34 or later. Remove or restrict access to sensitive files in the Rhymix package. Ensure administrator privileges are tightly controlled and validate all user-controlled inputs in the importer module. Monitor network traffic for unusual SSRF activity.

Useful 0 Not Useful 0