Executive brief
CuteNews is a lightweight content management system used to publish news and articles on websites. The Media Manager's "Upload by URL" feature contains a vulnerability that allows attackers to make unauthorized requests to internal or external systems on behalf of the server, potentially exposing sensitive data or accessing restricted resources. An attacker with access to the upload function could use this to probe internal networks or fetch sensitive files.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the upload_from_inet function of core/modules/media.php that fails to properly validate or restrict URLs provided to the "Upload by URL" feature. An authenticated attacker can supply arbitrary URLs that the server will fetch, allowing exfiltration of internal resources, port scanning, or interaction with internal services. A patch should restrict URL schemes and implement hostname validation to prevent access to private IP ranges.
Affected products
- CuteNews CuteNews 2.1.2
Timeline
- 2026-09-21: disclosed