# CVE-2026-100900: DevaslanPHP project-management server-side request forgery in Jira Import

Source: https://junglewise.ai/threats/cve-2026-100900-a-vulnerability-has-been-found-in-devaslanphp-project-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-100900 · Severity: medium · CVSS 5.5 · Published 2026-09-28

DevaslanPHP project-management is a PHP-based project management application. A server-side request forgery vulnerability in the Jira Import feature allows authenticated attackers to make arbitrary HTTP requests from the server by manipulating host, username, and token parameters. An attacker could use this to probe internal networks, access internal services, or exfiltrate data from systems accessible to the vulnerable server.

Technologies: [DevaslanPHP Project-Management](https://junglewise.ai/threats/technologies/project-management). Vendors: [DevaslanPHP](https://junglewise.ai/threats/vendors/devaslanphp).

## Quick answers

**Is CVE-2026-100900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100900 being exploited in the wild.

**How severe is CVE-2026-100900?** Medium severity, with a CVSS score of 5.5, published 28 September 2026.

**Which products and versions are affected?** DevaslanPHP Project-Management 1.2.1, 1.2.2, 1.2.3, 1.2.4, v2.0.0-beta1.

**Is there a fix for CVE-2026-100900?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100900 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100900?** Check whether you run DevaslanPHP Project-Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the updateJiraProjects function of the Jira Import component (/jira-import), where user-supplied host, username, and token parameters are passed directly to Guzzle HTTP client without URL scheme allowlisting, host denylisting, or outbound request sandboxing. The attack is triggered via Livewire API syncInput and callMethod operations after an authenticated user accesses the /jira-import page. An attacker with network access can exploit this to perform SSRF attacks against internal or private systems.

## Affected products

- DevaslanPHP project-management 1.2.1, 1.2.2, 1.2.3, 1.2.4, v2.0.0-beta1

## Timeline

- 2026-09-28: disclosed

## References

- [https://github.com/dddwmr/CVE/blob/main/Server-Side%20Request%20Forgery%20in%20Jira%20Import%20via%20Controllable%20Host%20and%20Missing%20canAccess%20.md](https://github.com/dddwmr/CVE/blob/main/Server-Side%20Request%20Forgery%20in%20Jira%20Import%20via%20Controllable%20Host%20and%20Missing%20canAccess%20.md)
- [https://vuldb.com/cve/CVE-2026-100900](https://vuldb.com/cve/CVE-2026-100900)

## Related threats

- [DevaslanPHP project-management SQL injection in Timesheet Dashboard](https://junglewise.ai/threats/cve-2026-100899-a-flaw-has-been-found-in-devaslanphp-project-management-1-2-1-1)
- [DevaslanPHP project-management SQL injection in Timesheet Dashboard](https://junglewise.ai/threats/cve-2026-100898-a-vulnerability-was-detected-in-devaslanphp-project-management-1)
- [DevaslanPHP project-management improper authorization in KanbanScrumHelper](https://junglewise.ai/threats/cve-2026-10285-devaslanphp-project-management-improper-authorization-in)
- [DevaslanPHP project-management improper authorization in ticket comments](https://junglewise.ai/threats/cve-2026-10284-devaslanphp-project-management-improper-authorization-in-ticket)