CVE-2026-90710: Tarzan CMS SSRF Vulnerability

CVE-2026-90710 Overview

CVE-2026-90710 is a Server-Side Request Forgery (SSRF) vulnerability in taisan tarzan-cms version 1.0.0. The flaw resides in the openConnection function within com/tarzan/cms/modules/admin/service/biz/ThemeService.java, part of the Theme Download Function. An attacker can manipulate the httpUrl argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is remotely exploitable and the exploit has been publicly disclosed. The project maintainers were notified through an early issue report but have not responded. This weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Remote unauthenticated attackers can abuse the Theme Download Function to force the tarzan-cms server to reach internal network resources, cloud metadata endpoints, or arbitrary external systems.

Affected Products

taisan tarzan-cms 1.0.0
Component: Theme Download Function
File: com/tarzan/cms/modules/admin/service/biz/ThemeService.java

Discovery Timeline

2026-09-14 - CVE-2026-90710 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90710

Vulnerability Analysis

The vulnerability exists in the theme download workflow of tarzan-cms. When an administrator or attacker supplies a value to the httpUrl parameter, the openConnection method in ThemeService.java opens a connection to that URL without sufficient validation of the destination host, scheme, or IP address. This allows the server to fetch content from any URL an attacker specifies. The public disclosure of exploit details raises the practical risk of automated scanning and abuse against exposed instances.

Root Cause

The root cause is missing input validation and destination filtering on the httpUrl parameter passed to openConnection. The application trusts user-supplied URLs and issues outbound requests directly, without enforcing an allowlist of hosts, blocking private IP ranges, or restricting URL schemes. This is a textbook [CWE-918] SSRF pattern where the server acts as a proxy for the attacker.

Attack Vector

An attacker sends a request to the theme download endpoint with a crafted httpUrl value pointing at an internal service, cloud metadata endpoint such as 169.254.169.254, or a loopback address. The tarzan-cms server initiates the outbound HTTP connection on the attacker's behalf and may return response data or side effects. The attack requires network access to the application and no authentication assumption is documented in the advisory. Because the exploit has been publicly disclosed, weaponization is straightforward.

No verified proof-of-concept code has been published to a trusted repository. Refer to the VulDB entry for CVE-2026-90710 and the Gitee issue tracker entry for additional technical context.

Detection Methods for CVE-2026-90710

Indicators of Compromise

Outbound HTTP connections from the tarzan-cms application server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
Requests from the tarzan-cms server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Access log entries referencing the theme download endpoint with httpUrl parameters pointing to non-theme-repository destinations.

Detection Strategies

Inspect application logs for calls into ThemeService.openConnection and correlate the URLs requested against an expected theme-source allowlist.
Deploy egress monitoring on the tarzan-cms host to flag outbound connections outside of expected theme repository domains.
Use web application firewall (WAF) rules to detect suspicious httpUrl values containing internal IP literals, alternate encodings, or non-HTTP schemes such as file://, gopher://, or dict://.

Monitoring Recommendations

Forward web server, application, and network flow logs to a centralized analytics platform for correlation of inbound requests with outbound SSRF-driven traffic.
Alert on any request from the tarzan-cms host to metadata or internal management interfaces that historically receive no traffic from this system.
Baseline normal theme download destinations and generate alerts on deviations.

How to Mitigate CVE-2026-90710

Immediate Actions Required

Restrict administrative access to the tarzan-cms Theme Download Function through network access controls until a fix is available.
Place tarzan-cms behind a reverse proxy or WAF that blocks httpUrl parameters containing private, loopback, or link-local IP ranges.
Enforce egress filtering so the tarzan-cms server can only reach approved theme repository hosts.

Patch Information

No vendor patch is available at the time of publication. The maintainers of taisan tarzan-cms were notified through the Gitee issue tracker but have not responded. Monitor the Gitee project repository for updates.

Workarounds

Disable the Theme Download Function if it is not required in your deployment.
Implement a URL allowlist in a proxy layer so only known theme repository hostnames can be reached from the application server.
Block outbound access from the tarzan-cms host to metadata IPs (169.254.169.254) and internal-only network segments.
Require authenticated access to any endpoint that invokes remote content retrieval, and enforce strict URL scheme validation limited to https://.

bash

# Example iptables egress policy restricting the tarzan-cms host
# Block access to cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP
# Block outbound access to internal RFC1918 ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
# Allow only approved theme repository host
iptables -A OUTPUT -p tcp -d approved-theme-repo.example.com --dport 443 -j ACCEPT