Is CVE-2026-85380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85380 being exploited in the wild.

How severe is CVE-2026-85380?

High severity, with a CVSS score of 7.3, published 4 September 2026.

Which products and versions are affected?

light0011 cms rolling release model; affected commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier.

Is there a fix for CVE-2026-85380?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85380 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85380?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85380: light0011 cms server-side request forgery in UEditor

CVE-2026-85380 · Severity: high · CVSS 7.3 · Published 2026-09-04

light0011 cms is a news content management system built on ThinkPHP that allows users to publish articles with rich media. An unauthenticated server-side request forgery vulnerability in the UEditor image-fetching component allows attackers to make arbitrary HTTP requests from the server, read internal service responses, and publish those contents publicly—potentially exposing internal administrative interfaces and credentials.

Quick answers

Is CVE-2026-85380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85380 being exploited in the wild.
How severe is CVE-2026-85380?: High severity, with a CVSS score of 7.3, published 4 September 2026.
Which products and versions are affected?: light0011 cms rolling release model; affected commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier.
Is there a fix for CVE-2026-85380?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85380 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85380?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the UEditor catchimage endpoint (Public/ueditor/php/controller.php, lines 15–45). The endpoint accepts unauthenticated requests with a source[] parameter containing arbitrary URLs, which are fetched by the Uploader class without IP allowlisting, DNS rebinding protection, or redirect validation. The vulnerable Uploader.class.php code (lines 182–210) calls get_headers() and readfile() on attacker-supplied URLs; content-type filtering is bypassed by appending a fragment like #allowed.png, and the fetched response body is written to a public web directory. An attacker can probe internal services, extract response bodies, and republish them via the returned public URL, exposing admin interfaces and credentials.

Affected products

light0011 cms rolling release model; affected commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier

Timeline

2026-07-18: disclosed: Vulnerability reported via GitHub issue
2026-09-04: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.