CVEvulnerability

CVE-2025-59055

7.2 HIGH Published 2025-09-11 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-09-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918

Description

InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.

Affected configurations

• instantcms instantcms (<= 2.17.3)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References