CVE-2026-90710
Deferred Deferred - Pending Action

Server-Side Request Forgery in Taisan Tarzan-CMS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90710
EUVD
EUVD-2026-77430

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
taisancms tarzan-cms 1.0.0
taisan tarzan-cms 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90710 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Tarzan CMS, a content management system. The issue arises from an incorrect Shiro permission configuration where the filter chain definitions are improperly ordered. Specifically, the wildcard path /theme/ is granted anonymous access before more restrictive permission rules are applied, allowing attackers to bypass authentication and access the theme management module's remote download functionality without authorization.

Detection Guidance

To detect this SSRF vulnerability in Tarzan CMS, inspect the Shiro filter chain configuration in ShiroService.java for improper ordering of permission rules. Check if the wildcard path /theme/ is granted anonymous access before more restrictive rules. Use network monitoring tools to detect unusual outbound requests from the application, especially to internal or unexpected destinations.

Impact Analysis

This vulnerability allows attackers to remotely probe internal network environments using techniques like DNS rebinding. It can also be chained with other vulnerabilities such as CVE-2025-1113 for deserialization attacks, potentially leading to unauthorized access, data exfiltration, or further system compromise.

Compliance Impact

This SSRF vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to internal systems. GDPR requires protecting personal data and preventing unauthorized access, while HIPAA mandates secure handling of protected health information. The flaw allows attackers to probe internal networks, which could lead to unauthorized data exposure or breaches of confidentiality requirements in these regulations.

Mitigation Strategies

Immediately update the Shiro filter chain configuration to ensure restrictive permissions (perms[theme:]) are applied before any anonymous access rules. Remove or restrict anonymous access to the /theme/ path. Monitor network traffic for suspicious outbound connections and apply network-level restrictions to prevent SSRF attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart