CVE-2026-40500: ProcessWire CMS SSRF Vulnerability

CVE-2026-40500 Overview

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery (SSRF) vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

Critical Impact

Authenticated administrators can leverage the vulnerable module download functionality to probe internal network infrastructure, enumerate hosts and services, and potentially access sensitive cloud metadata endpoints such as AWS EC2 instance credentials.

Affected Products

• ProcessWire CMS version 3.0.255 and prior versions

Discovery Timeline

• April 15, 2026 - CVE-2026-40500 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40500

Vulnerability Analysis

This SSRF vulnerability (CWE-918) exists in the ProcessWire CMS admin panel's module installation workflow. The 'Add Module From URL' functionality accepts user-supplied URLs without adequate validation or restriction, allowing the web server to make arbitrary outbound HTTP requests on behalf of the attacker.

The attack requires administrator-level authentication to access the vulnerable endpoint, limiting the initial attack surface. However, once an attacker has compromised or obtained administrator credentials, the vulnerability provides a powerful foothold for internal network reconnaissance and potential lateral movement.

The server returns differentiable error messages based on the response status from target hosts, enabling blind SSRF attacks with reliable inference capabilities. This allows attackers to determine whether internal hosts are alive, which ports are open, and potentially retrieve sensitive data from internal services that trust requests originating from the web server.

Root Cause

The root cause of this vulnerability is improper input validation and lack of URL restrictions in the module download parameter. The application fails to implement allowlist-based URL validation, does not block requests to private IP ranges (RFC-1918), and does not restrict requests to localhost or cloud metadata endpoints. The server processes arbitrary URLs without verifying that they point to legitimate module repositories.

Attack Vector

The attack vector is network-based, requiring authenticated access to the ProcessWire CMS admin panel. An attacker with administrator credentials can navigate to the module installation interface and submit malicious URLs targeting:

• Internal network hosts (e.g., http://192.168.1.1/, http://10.0.0.1/)
• Cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/)
• Internal services running on non-standard ports
• Localhost services (e.g., http://127.0.0.1:8080/)

The vulnerability is exploited by submitting crafted URLs through the 'Add Module From URL' feature and observing the server's response behavior to infer information about the target. Differentiable error messages enable port scanning and host enumeration without direct visibility into the actual responses.

For detailed proof-of-concept information, refer to the GitHub Gist PoC Repository and the Vulncheck Advisory.

Detection Methods for CVE-2026-40500

Indicators of Compromise

• Unusual outbound HTTP requests from the web server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) originating from the ProcessWire application
• High volume of module installation attempts with varying target URLs
• Admin panel access logs showing repeated use of the 'Add Module From URL' feature with non-standard URLs

Detection Strategies

• Monitor web server egress traffic for connections to RFC-1918 private IP ranges and cloud metadata endpoints
• Implement web application firewall (WAF) rules to detect and block SSRF patterns in URL parameters
• Review ProcessWire admin access logs for anomalous module installation activity
• Deploy network-level detection for unusual server-initiated connections to internal infrastructure

Monitoring Recommendations

• Enable verbose logging for the ProcessWire admin panel module installation feature
• Configure alerting for outbound connections from the web server to internal network segments
• Monitor for authentication anomalies that may indicate compromised administrator accounts
• Implement network segmentation monitoring to detect lateral movement attempts

How to Mitigate CVE-2026-40500

Immediate Actions Required

• Restrict network access to the ProcessWire admin panel to trusted IP addresses only
• Implement egress filtering on the web server to block outbound connections to private IP ranges and metadata endpoints
• Review and audit administrator account access and credentials
• Consider disabling the 'Add Module From URL' feature if not required for operations

Patch Information

At the time of publication, no official patch has been released for this vulnerability. Organizations should monitor the ProcessWire website and official channels for security updates. Refer to the Vulncheck Advisory for the latest remediation guidance.

Workarounds

• Disable the 'Add Module From URL' functionality and use manual module installation via file upload instead
• Implement network-level egress filtering to prevent the web server from making requests to internal IP ranges
• Deploy a web application firewall with SSRF protection rules
• Use network segmentation to isolate the web server from sensitive internal resources

# Example iptables rules to block outbound SSRF to private ranges
# Apply to the web server hosting ProcessWire CMS

# Block outbound connections to RFC-1918 private IP ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Block outbound connections to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP