Executive brief
Instatic is an open-source visual CMS platform used to build and host static websites. An unauthenticated attacker can poison the server's shared render cache by sending specially crafted requests to a specific endpoint, potentially causing other users to receive malicious or incorrect cached content without authorization.
Technical details
The vulnerability is a cache poisoning flaw in CoreBunch/Instatic versions through 0.0.14, accessible via the GET /_instatic/hole/<nodeId> server island endpoint. An unauthenticated remote attacker can manipulate the 'u' query parameter to inject malicious content into the process-wide render cache. This allows the attacker to poison cached responses that are served to all subsequent users without authentication or user interaction required. The attack targets the shared cache mechanism, causing legitimate users to receive attacker-controlled content from their normal requests.
Affected products
- CoreBunch Instatic through 0.0.14
Timeline
- 2026-08-10: disclosed