CVE-2026-48707CWE-918ssrf

CVE-2026-48707

Low · published September 8, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-08T22:17Z
References (3)
https://github.com/instantsoft/icms2/commit/04b8fe0eb75fc5f44eecb15684c7d3660586683d · [email protected]https://github.com/instantsoft/icms2/security/advisories/GHSA-cm47-mwv3-f534 · [email protected]https://github.com/instantsoft/icms2/security/advisories/GHSA-cm47-mwv3-f534 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 08 SEP 17:26Z
    InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
    cvelistv5