CVE-2025-59055: InstantCMS SSRF Vulnerability Explained

CVE-2025-59055 Overview

CVE-2025-59055 is a blind Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in InstantCMS versions up to and including 2.17.3. The flaw resides in the installer functionality, where the package parameter accepts arbitrary HTTP and HTTPS URLs without host validation. Authenticated remote attackers can coerce the server into issuing requests to internal services, scanning local networks, or invoking arbitrary endpoints. The same primitive enables denial of service through resource exhaustion and can disclose the origin server IP when the application sits behind a reverse proxy.

Critical Impact
An authenticated attacker can pivot from a web-facing InstantCMS deployment into internal infrastructure, probe local services, or exhaust server resources via the installer package parameter.

Affected Products

InstantCMS versions up to and including 2.17.3
instantsoft/icms2 package distributions
Deployments using the administrative installer functionality

Discovery Timeline

2025-09-11 - CVE-2025-59055 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59055

Vulnerability Analysis

The vulnerability lives in the administrative package installer, which fetches add-on packages from remote URLs supplied through the package parameter. The uploader component had remote upload enabled with no allowlist of acceptable hosts. Any string accepted by PHP's HTTP stream wrappers becomes a valid target, including internal hostnames, loopback addresses, and cloud metadata endpoints.

Because the response body is not reflected back to the attacker, exploitation is blind. Attackers infer success through timing, error messages, or side effects on backend services. The vulnerability requires high privileges, since only authenticated administrators can reach the installer endpoint.

Root Cause

The uploadPackage() method in system/controllers/admin/actions/install.php called enableRemoteUpload() on the uploader without restricting destination hosts. The uploader class in system/core/uploader.php had no allowed_remote_hosts property, so every remote URL passed validation. Missing input filtering on a server-side fetch primitive is the canonical pattern described by [CWE-918].

Attack Vector

An authenticated administrator submits a crafted package URL pointing to an internal target such as http://127.0.0.1:6379/, http://169.254.169.254/latest/meta-data/, or any reachable internal HTTP service. The InstantCMS server issues the outbound request from its own network position. Attackers use this primitive to map internal services, trigger functions on unauthenticated internal APIs, fingerprint reverse-proxy origin IPs, or flood the server with concurrent fetch requests for denial of service.

php

// Patched code from system/controllers/admin/actions/install.php
private function uploadPackage() {

-    $this->cms_uploader->enableRemoteUpload();
+    $this->cms_uploader->enableRemoteUpload()
+        ->setAllowedRemoteHosts(['instantcms.ru', 'api.instantcms.ru', 'addons.instantcms.ru']);

    if (!$this->cms_uploader->isUploaded($this->upload_name)
        && !$this->cms_uploader->isUploadedFromLink($this->upload_name)) {

Source: GitHub commit fa997bd

Detection Methods for CVE-2025-59055

Indicators of Compromise

Outbound HTTP/HTTPS connections originating from the InstantCMS web server to RFC1918 ranges, loopback, or cloud metadata IPs such as 169.254.169.254.
Web server access logs showing administrator-authenticated POST requests to the installer action with a package parameter containing a URL.
Repeated installer requests in short succession, indicating attempted resource exhaustion or internal port scanning.
DNS queries from the web server resolving unexpected internal hostnames.

Detection Strategies

Monitor egress traffic from InstantCMS hosts and alert on connections to private address space or metadata services.
Inspect web server logs for installer endpoints invoked with externally controlled URL parameters and correlate with the authenticated session.
Apply rules that flag administrator accounts triggering high-volume outbound fetches within short time windows.

Monitoring Recommendations

Forward web server, PHP-FPM, and firewall egress logs to a centralized SIEM and retain them for forensic review.
Track administrator login geolocation and session anomalies to identify compromised privileged accounts.
Baseline normal outbound destinations from the CMS host and alert on deviations.

How to Mitigate CVE-2025-59055

Immediate Actions Required

Restrict administrative access to the InstantCMS backend using IP allowlisting or VPN-only access until a patched release is available.
Audit administrator accounts, rotate credentials, and enforce multi-factor authentication on privileged users.
Place egress filtering between the InstantCMS host and internal networks to block requests to RFC1918 ranges, loopback, and cloud metadata endpoints.
Review installer activity in logs for prior abuse of the package parameter.

Patch Information

As of CVE publication, no tagged patched release of InstantCMS was available. The upstream fix is committed in instantsoft/icms2 at commit fa997bd, which introduces an allowed_remote_hosts allowlist limited to instantcms.ru, api.instantcms.ru, and addons.instantcms.ru. Refer to the GHSA-79hh-mhvg-whrw advisory for tracking the official release.

Workarounds

Apply the upstream commit manually to system/controllers/admin/actions/install.php and system/core/uploader.php to enforce the host allowlist.
Disable the package installer functionality in production environments and perform package installation in a controlled staging environment.
Configure the host firewall to deny outbound traffic from the PHP worker to internal subnets and metadata services.

bash

# Example egress restriction using iptables on the InstantCMS host
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254/32 -j REJECT