Executive brief
DoraCMS, an enterprise-grade content management system, contains a security flaw in its image handling component. This vulnerability allows an attacker to force the server to make unauthorized web requests to internal or external systems. This could be used to scan private internal networks or cause a service outage by exhausting the server's resources.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in DoraCMS version 3.1 and prior within the UEditor 'remote image catcher' functionality. The application uses http.request and https.request to fetch user-supplied URLs without enforcing allowlists, blocking private IP ranges, or implementing resource safety controls like timeouts and response size limits. An unauthenticated remote attacker can exploit this to perform internal network scanning or trigger a denial-of-service (DoS) condition by forcing the server to buffer large responses into memory. The vulnerability is rooted in the UEditor integration within the upload module.
Affected products
- doramart DoraCMS 3.1 and prior
Timeline
- 2026-02-10: disclosed: Initial disclosure via GitHub issue and VulnCheck advisory
- 2026-02-10: advisory: CVE-2026-25870 published