Description

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source[] causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T01:17:22.710Z",
  "pubdate": "2026-09-04T01:17:22.710Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the catchimage function within the UEditor component of light0011 cms (commit c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930).\nThe vulnerability originates from insecure handling of user-supplied input via the source[] array argument.\nBy manipulating this parameter, an unauthenticated remote attacker can force the web server to initiate arbitrary HTTP requests to internal or external resources.\nThis capability allows attackers to bypass network perimeters, probe internal services, or interact with restricted APIs that are otherwise unreachable from the public internet.\nAs the project utilizes a rolling release model and lacks a formal patch at this time, the risk remains high for deployments using the affected source code versions.\nThe availability of public exploit code increases the likelihood of malicious exploitation.",
  "technicalDetails": "The vulnerability resides within the Public/ueditor/php/controller.php file of the UEditor component, specifically targeting the catchimage function. This function is designed to fetch remote images for storage on the local server; however, it fails to perform adequate validation or sanitization on the input provided through the source[] array.\nThe root cause is an insufficient input validation mechanism that allows an attacker to supply arbitrary URLs. When the controller processes this request, it initiates a connection to the specified destination using the server's context. Because the application logic does not implement an allowlist for target domains or IP ranges, the underlying server-side request functionality can be coerced into interacting with unauthorized endpoints.\nThe attack flow begins when an attacker sends a crafted request to the endpoint responsible for invoking the catchimage function. By populating the source[] parameter with malicious or internal URIs, the attacker forces the PHP backend to execute an HTTP request to the victim-chosen address. This process effectively turns the application into a proxy or an attack vector.\nExploitation requires no prior authentication, as the vulnerable endpoint is exposed to the network. An attacker can leverage this SSRF to perform reconnaissance on the internal network topology, identify active services behind firewalls, or interact with metadata services (such as those in cloud environments) to retrieve sensitive configuration data or temporary credentials.\nSince the UEditor component is designed for content management, the server-side request originates from a trusted context, potentially bypassing standard security groups. The lack of proper request origin verification or URI filtering allows the payload to reach internal resources that are not intended for public access. The post-exploitation impact includes the potential for information disclosure, unauthorized service interaction, and, in specific configurations, the execution of arbitrary actions on internal APIs if those services rely on IP-based authentication or lack additional security layers."
}