CVE-2026-85380
Received Received - Intake

Server-Side Request Forgery in Light0011 CMS UEditor

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source[] causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85380
EUVD
EUVD-2026-70853

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
light0011 cms From f72cf46f601efb2a0618c3814cc2f61380b38930 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the UEditor component of a CMS application. It allows unauthenticated attackers to make the server fetch arbitrary HTTP URLs and read internal responses. The flaw is in the catchimage function of Public/ueditor/php/controller.php, which processes user-controlled source[] inputs without proper restrictions.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unusual outbound requests from your server, particularly to internal or private IP addresses. Check logs for POST requests to the catchimage endpoint in Public/ueditor/php/controller.php with suspicious source[] parameters. Use tools like curl to test the endpoint with crafted URLs containing fragments or internal addresses.

  • Test with: curl -X POST -d 'source[]=http://localhost:18090/test#.png' http://your-server/Public/ueditor/php/controller.php?action=catchimage
Impact Analysis

Attackers could probe internal services, read sensitive HTTP responses, and expose confidential data like admin credentials or metadata. They can also publish fetched content publicly via generated URLs, potentially leaking internal network information.

Compliance Impact

This SSRF vulnerability could expose sensitive internal services or data, potentially violating GDPR by unauthorized access to personal data or HIPAA by exposing protected health information if such systems are present in the environment.

Mitigation Strategies

Immediately restrict access to the catchimage endpoint by requiring authentication for UEditor actions. Disable remote fetching unless absolutely necessary and implement strict URL allowlists. Block private, loopback, link-local, and reserved IP addresses. Store fetched data outside the web root to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart