CVE-2026-18856: Poesis Rhymix CMS SSRF Vulnerability

CVE-2026-18856 Overview

CVE-2026-18856 is a Server-Side Request Forgery (SSRF) vulnerability in Poesis Rhymix CMS versions up to 2.1.33. The flaw resides in the procImporterAdminCheckXmlFile function of modules/importer/importer.admin.controller.php within the Data Import Module. An authenticated attacker can manipulate the filename argument to coerce the server into issuing arbitrary HTTP requests. The issue is tracked under [CWE-918] and has been publicly disclosed. Rhymix released version 2.1.34 to address the flaw.

Critical Impact
Authenticated remote attackers can abuse the Data Import Module to issue server-initiated requests, enabling internal network reconnaissance and interaction with services otherwise not exposed externally.

Affected Products

Poesis Rhymix CMS versions up to and including 2.1.33
Component: Data Import Module (modules/importer/importer.admin.controller.php)
Function: procImporterAdminCheckXmlFile

Discovery Timeline

2026-08-05 - CVE-2026-18856 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18856

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) [CWE-918] in the Rhymix CMS Data Import Module. The procImporterAdminCheckXmlFile function accepts a user-controlled filename argument and uses it to fetch content without sufficient validation of the target URL or scheme. An attacker with administrative access to the importer can supply an arbitrary URL as the filename value. The server then performs an outbound request to that destination on the attacker's behalf.

Because the request originates from the Rhymix server, it can reach internal hosts, cloud metadata endpoints, or other resources unreachable from the public internet. Public disclosure of the exploit increases the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is missing validation on the filename parameter passed to procImporterAdminCheckXmlFile. The function treats the argument as a fetchable resource without restricting the URL scheme, host, or destination address range. This allows the attacker-supplied value to be dereferenced by the server-side HTTP client.

Attack Vector

Exploitation requires network access to the Rhymix administrative interface and high-privilege credentials to reach the importer endpoint. The attacker submits a request to the importer administrator controller with a crafted filename parameter pointing to an internal or external URL. The Rhymix server issues the request and returns behavior or content that discloses information about reachable services. Refer to the GitHub SSRF Report and VulDB Vulnerability Details for technical write-ups. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-18856

Indicators of Compromise

Web server access logs containing POST requests to the importer admin controller with unusual filename values referencing internal IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints such as 169.254.169.254.
Outbound HTTP connections from the Rhymix web server process to hosts that are not part of normal import workflows.
Repeated importer requests originating from a single administrator session probing multiple internal hosts or ports.

Detection Strategies

Inspect application logs for calls to procImporterAdminCheckXmlFile where the filename parameter contains a URL scheme (http://, https://, file://, gopher://) rather than a local file path.
Correlate administrative session activity with outbound network flows from the CMS host to detect anomalous server-initiated requests.
Deploy web application firewall rules that flag importer requests carrying URL-encoded IP literals or non-whitelisted hostnames.

Monitoring Recommendations

Baseline expected outbound destinations for the Rhymix server and alert on deviations, particularly connections to RFC1918 addresses or metadata services.
Enable verbose logging on the importer module and forward events to a centralized log platform for retention and correlation.
Monitor administrator account activity for unusual login times, source IPs, or import operations that fall outside normal maintenance windows.

How to Mitigate CVE-2026-18856

Immediate Actions Required

Upgrade Rhymix CMS to version 2.1.34 or later using the Rhymix Release Archive.
Restrict access to the administrative interface to trusted IP ranges via network ACLs or reverse proxy rules.
Audit administrator accounts and rotate credentials for any account that could reach the importer endpoint.
Review recent web and application logs for exploitation attempts referencing procImporterAdminCheckXmlFile.

Patch Information

Rhymix has released version 2.1.34, which addresses the SSRF flaw. See the Rhymix News Update for release notes and download the fixed package from the official Rhymix Release Archive. Additional advisory information is available at VulDB CVE-2026-18856.

Workarounds

Disable or remove the Data Import Module if it is not required for site operations.
Enforce egress filtering on the web server so it can only reach explicitly approved external destinations.
Block outbound requests from the CMS host to internal management networks and cloud metadata services at the firewall layer.

bash

# Egress restriction example using iptables to block metadata endpoint
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT