# CVE-2026-40500: ProcessWire CMS SSRF in Add Module From URL feature

Source: https://junglewise.ai/threats/cve-2026-40500-processwire-cms-ssrf-in-add-module-from-url-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-40500 · Severity: medium · CVSS 6.8 · Published 2026-04-15

ProcessWire is a content management system used to build and manage websites. A security flaw in its module installation feature allows an administrator to force the server to make unauthorized requests to other systems. This could be used to scan the company's internal network, discover hidden services, or access sensitive cloud configuration data that is normally protected from the outside world.

Technologies: [processwire/processwire (Packagist)](https://junglewise.ai/threats/technologies/processwire-processwire). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-40500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40500 being exploited in the wild.

**How severe is CVE-2026-40500?** Medium severity, with a CVSS score of 6.8, published 15 April 2026.

**Which products and versions are affected?** processwire/processwire (Packagist) <= 3.0.255, ECOSYSTEM:introduced=0,last_affected=3.0.255; ProcessWire <= 3.0.255.

**Is there a fix for CVE-2026-40500?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40500 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40500?** Check whether you run processwire/processwire (Packagist) or ProcessWire at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in ProcessWire CMS (v3.0.255 and earlier) within the 'Add Module From URL' functionality of the admin panel. When the 'moduleInstallURL' configuration is enabled, the application fails to validate the 'download' parameter, allowing an authenticated administrator to input arbitrary URLs. The server then issues outbound HTTP requests via PHP functions like curl or fsockopen. Because the application returns highly descriptive error messages (e.g., distinguishing between 'Connection refused' and 'Unable to open ZIP file'), an attacker can reliably perform internal port scanning, host enumeration on private networks (RFC-1918), and access cloud metadata services (e.g., IMDSv1). The vulnerability is currently disputed but remains present in the specified versions.

## Affected products

- ProcessWire ProcessWire <= 3.0.255

## Identifiers

- CVE-2026-40500
- GHSA-gmwr-9j4p-96vm

## Timeline

- 2026-04-15: advisory: Initial advisory published by VulnCheck
- 2026-07-07: other: CVE record marked as disputed

## References

- [https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82](https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82)
- [https://processwire.com/](https://processwire.com/)
- [https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url](https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url)

## Related threats

- [ProcessWire CMS vulnerable to resource-exhaustion Denial of Service](https://junglewise.ai/threats/cve-2025-60790-processwire-cms-vulnerable-to-resource-exhaustion-denial-of)
- [ProcessWire Cross Site Request Forgery vulnerability](https://junglewise.ai/threats/cve-2024-41597-processwire-cross-site-request-forgery-vulnerability)
- [Arbitrary Code Execution in Processwire](https://junglewise.ai/threats/cve-2023-24676-arbitrary-code-execution-in-processwire)
- [ProcessWire vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2022-40487-processwire-vulnerable-to-cross-site-scripting)
- [ProcessWire vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2022-40488-processwire-vulnerable-to-cross-site-request-forgery)