CVE-2026-92380CWE-918ssrf

CVE-2026-92380

High · published September 16, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00495 · 41.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-16T19:19Z
References (6)
https://github.com/wuzhicms/wuzhicms/ · [email protected]https://github.com/wuzhicms/wuzhicms/issues/221 · [email protected]https://vuldb.com/cve/CVE-2026-92380 · [email protected]https://vuldb.com/submit/935194 · [email protected]https://vuldb.com/vuln/405512 · [email protected]https://vuldb.com/vuln/405512/cti · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 14:30Z
    WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
    cvelistv5