CVE-2026-92380: WuzhiCMS SSRF Vulnerability

CVE-2026-92380 Overview

CVE-2026-92380 is a server-side request forgery (SSRF) vulnerability in WuzhiCMS versions up to 4.1.0. The flaw resides in the ckditor::saveRemote function within coreframe/app/attachment/index.php, part of the Remote Image Fetch component. Attackers can manipulate the source[] argument to coerce the server into issuing arbitrary HTTP requests to attacker-chosen destinations. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, and the WuzhiCMS project was notified through an issue report but has not yet responded.

Critical Impact
Unauthenticated remote attackers can force the WuzhiCMS server to send arbitrary HTTP requests, enabling internal network reconnaissance, access to metadata endpoints, and interaction with internal services otherwise shielded from the public internet.

Affected Products

WuzhiCMS versions up to and including 4.1.0
Component: Remote Image Fetch (coreframe/app/attachment/index.php)
Vulnerable function: ckditor::saveRemote

Discovery Timeline

2026-09-16 - CVE-2026-92380 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92380

Vulnerability Analysis

The vulnerability is classified under [CWE-918] Server-Side Request Forgery. WuzhiCMS exposes a remote image retrieval feature through ckditor::saveRemote, which accepts user-supplied URLs via the source[] parameter and fetches the referenced resources server-side. The function fails to validate or restrict the destination of these fetches. As a result, an attacker can supply URLs pointing to internal hosts, loopback interfaces, or cloud metadata services. The server processes the request under its own network identity, bypassing perimeter controls that would otherwise block such traffic from external clients.

Because the endpoint requires no authentication, exploitation can be performed by any remote actor capable of reaching the WuzhiCMS instance. The impact scope includes confidentiality, integrity, and availability of resources reachable from the application server.

Root Cause

The root cause is missing input validation on the source[] parameter processed by ckditor::saveRemote. The function does not enforce an allowlist of permitted hosts, does not filter private or reserved IP ranges, and does not restrict protocol schemes. Any URL passed through the array is fetched without sanitization.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the Remote Image Fetch endpoint with source[] set to an internal URL such as http://127.0.0.1:8080/admin or a cloud provider metadata address. The WuzhiCMS server issues the outbound request and may return or process the response. Attackers can enumerate internal services, retrieve cloud instance credentials, or pivot toward internal APIs. Refer to the VulDB CVE-2026-92380 Entry and the GitHub Issue #221 Discussion for additional context.

No verified proof-of-concept code is reproduced here. See the VulDB Vulnerability #405512 entry for public exploit references.

Detection Methods for CVE-2026-92380

Indicators of Compromise

Web server access logs showing POST or GET requests to coreframe/app/attachment/index.php containing source[] parameters with unusual URLs.
Outbound HTTP connections from the WuzhiCMS server to internal IP ranges (RFC1918), loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
Unexpected fetches to non-image URLs or non-standard ports originating from the CMS application user.

Detection Strategies

Deploy web application firewall rules that inspect source[] values submitted to the attachment endpoint and block references to private, loopback, or link-local addresses.
Monitor server egress traffic for connections initiated by the PHP process to internal subnets or cloud metadata IPs.
Correlate anomalous outbound requests with inbound requests to ckditor::saveRemote to identify SSRF activity patterns.

Monitoring Recommendations

Enable verbose logging on the WuzhiCMS attachment component and forward logs to a centralized analytics platform for review.
Instrument network egress filtering and alert on any outbound requests from the web server to non-approved destinations.
Baseline normal remote-image fetch activity and generate alerts on deviations in destination hosts, request volume, or response size.

How to Mitigate CVE-2026-92380

Immediate Actions Required

Restrict access to coreframe/app/attachment/index.php from untrusted networks using firewall or reverse proxy rules until a vendor patch is available.
Block outbound requests from the WuzhiCMS server to internal IP ranges, loopback addresses, and cloud metadata endpoints at the network layer.
Audit web server logs for prior exploitation attempts targeting the source[] parameter.

Patch Information

No official patch is available at the time of publication. The WuzhiCMS project was notified through an issue report but has not responded. Monitor the GitHub Repository for Wuzhicms and GitHub Issue #221 Discussion for updates on remediation.

Workarounds

Disable the Remote Image Fetch feature if it is not required by editorial workflows.
Deploy an egress proxy that enforces an allowlist of permitted image hosting domains for outbound fetches by the CMS.
Apply a virtual patch through a web application firewall to reject requests where source[] contains non-HTTP schemes, private IPs, or hostnames that resolve to reserved ranges.

bash

# Example egress restriction using iptables to block SSRF pivots to metadata service
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT