Quick answers
- Is CVE-2026-79425 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79425 being exploited in the wild.
- How severe is CVE-2026-79425?
- High severity, with a CVSS score of 8.1, published 15 September 2026.
- Which products and versions are affected?
- CRMEB CRMEB 6.0.0.
- Is there a fix for CVE-2026-79425?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-79425 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-79425?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CRMEB v6.0.0 contains a server-side request forgery (SSRF) vulnerability in the /adminapi/file/online_upload endpoint. The online_upload method accepts an array of image URLs from an authenticated administrator and passes them directly to CopyTaobaoServices::downloadImage() without validating that the destinations are approved hosts. The vulnerable code uses cURL or PHP URL reading functions to fetch the supplied URLs without blocking loopback, private, or metadata service ranges. An attacker with administrator privileges and file-management permissions can craft a malicious POST request containing attacker-controlled URLs to scan internal services, probe private networks, or extract data from internal endpoints. The vulnerability requires prior authentication and administrative privilege but allows arbitrary HTTP requests from the server's network position.
Affected products
- CRMEB CRMEB 6.0.0
Timeline
- 2026-09-15: disclosed