Is CVE-2026-55372 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55372 being exploited in the wild.

How severe is CVE-2026-55372?

High severity, with a CVSS score of 7.2, published 13 July 2026.

Which products and versions are affected?

NukeViet < 4.6.00; nukeviet/nukeviet (Packagist) < 4.6.00, ECOSYSTEM:introduced=0,fixed=4.6.00.

Is there a fix for CVE-2026-55372?

Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55372 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55372?

Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55372: NukeViet SSRF via X-Forwarded-Host in server_info_update

Q: Which products and versions are affected?

NukeViet < 4.6.00; nukeviet/nukeviet (Packagist) < 4.6.00, ECOSYSTEM:introduced=0,fixed=4.6.00.

Q: Is there a fix for CVE-2026-55372?

Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55372 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55372?

Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55372 · Severity: high · CVSS 7.2 · Published 2026-07-13

NukeViet, a popular open-source content management system, is vulnerable to a security flaw that allows unauthorized individuals to force the server to make requests to internal or external systems. By manipulating specific web headers, an attacker can use the server as a proxy to scan internal networks or discover active services that are not normally accessible from the internet. This could lead to the exposure of internal network structure or the poisoning of cached server data, potentially affecting site performance and security.

Technologies: NukeViet, nukeviet/nukeviet (Packagist). Vendors: NukeViet, Packagist.

Quick answers

Is CVE-2026-55372 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55372 being exploited in the wild.
How severe is CVE-2026-55372?: High severity, with a CVSS score of 7.2, published 13 July 2026.
Which products and versions are affected?: NukeViet < 4.6.00; nukeviet/nukeviet (Packagist) < 4.6.00, ECOSYSTEM:introduced=0,fixed=4.6.00.
Is there a fix for CVE-2026-55372?: Yes. nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55372 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55372?: Check whether you run NukeViet or nukeviet/nukeviet (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nukeviet/nukeviet (Packagist): upgrade to 4.6.00 or later
```
composer require nukeviet/nukeviet:^4.6.00
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in NukeViet due to improper validation of 'X-Forwarded-Host' and 'X-Forwarded-Proto' headers. The 'server_info_update()' function in 'includes/ini.php' uses these attacker-controlled headers to construct a URL for a cURL request without verifying them against the 'my_domains' allow-list. An attacker can bypass host sanitization by appending a slash to the port (e.g., '127.0.0.1:8081/'), which evades the regex intended to strip trailing ports. This allows unauthenticated remote attackers to perform blind, HEAD-only SSRF for internal port scanning and poisoning the 'config_ini' cache. The issue is fixed in version 4.6.00 by implementing stricter header validation and domain allow-listing.

Affected products

NukeViet NukeViet < 4.6.00

Identifiers

CVE-2026-55372
GHSA-4chg-4752-w88r

Timeline

2026-07-13: advisory
2026-07-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.