Executive brief
ProcessWire is a content management system used to build and manage websites. A security flaw in its module installation feature allows an administrator to force the server to make unauthorized requests to other systems. This could be used to scan the company's internal network, discover hidden services, or access sensitive cloud configuration data that is normally protected from the outside world.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in ProcessWire CMS (v3.0.255 and earlier) within the 'Add Module From URL' functionality of the admin panel. When the 'moduleInstallURL' configuration is enabled, the application fails to validate the 'download' parameter, allowing an authenticated administrator to input arbitrary URLs. The server then issues outbound HTTP requests via PHP functions like curl or fsockopen. Because the application returns highly descriptive error messages (e.g., distinguishing between 'Connection refused' and 'Unable to open ZIP file'), an attacker can reliably perform internal port scanning, host enumeration on private networks (RFC-1918), and access cloud metadata services (e.g., IMDSv1). The vulnerability is currently disputed but remains present in the specified versions.
Affected products
- ProcessWire ProcessWire <= 3.0.255
Timeline
- 2026-04-15: advisory: Initial advisory published by VulnCheck
- 2026-07-07: other: CVE record marked as disputed