Executive brief
light0011 cms is a news content management system built on ThinkPHP that allows users to publish articles with rich media. An unauthenticated server-side request forgery vulnerability in the UEditor image-fetching component allows attackers to make arbitrary HTTP requests from the server, read internal service responses, and publish those contents publicly—potentially exposing internal administrative interfaces and credentials.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the UEditor catchimage endpoint (Public/ueditor/php/controller.php, lines 15–45). The endpoint accepts unauthenticated requests with a source[] parameter containing arbitrary URLs, which are fetched by the Uploader class without IP allowlisting, DNS rebinding protection, or redirect validation. The vulnerable Uploader.class.php code (lines 182–210) calls get_headers() and readfile() on attacker-supplied URLs; content-type filtering is bypassed by appending a fragment like #allowed.png, and the fetched response body is written to a public web directory. An attacker can probe internal services, extract response bodies, and republish them via the returned public URL, exposing admin interfaces and credentials.
Affected products
- light0011 cms rolling release model; affected commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier
Timeline
- 2026-07-18: disclosed: Vulnerability reported via GitHub issue
- 2026-09-04: advisory: NVD advisory published