Executive brief
e107 is a content management system used to build and manage websites. A security flaw in its media management tool allows authenticated administrators to force the server to make requests to internal network locations. This could allow an attacker to scan internal ports, bypass firewalls, or access sensitive information from the local environment that is not intended to be public.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in e107's Media Manager due to insufficient validation of remote URLs in the 'Image/File URL' field. The 'e_file::getRemoteFile()' and 'getRemoteContent()' methods failed to restrict IP ranges or protocols, allowing authenticated users with administrative access to probe internal services. Attackers can use this to perform port scans on the local host or access internal resources. The vulnerability also included a bypass mechanism using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) which evaded standard IP filters. Version 2.3.4 fixes this by implementing 'isUrlSafe()' checks, canonicalizing IP addresses, and restricting protocols to HTTP/HTTPS.
Affected products
- e107inc e107 < 2.3.4
Timeline
- 2026-04-25: patched: Fixes committed to repository
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: disclosed: CVE published to NVD