Executive brief
WuzhiCMS is a PHP-based content management system used to build and manage websites. A vulnerability in its remote image fetch functionality allows attackers to make unauthorized requests from the server to internal or external systems, potentially exposing sensitive data, bypassing network protections, or attacking internal infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the ckditor::saveRemote function within coreframe/app/attachment/index.php. An attacker can manipulate the source[] parameter to cause the WuzhiCMS server to fetch arbitrary URLs or connect to internal systems. The attack requires no authentication and can be initiated remotely over the network. An attacker can use this to perform reconnaissance, access internal services, or retrieve sensitive information from within the server's network context. No patch has been released as of the advisory date.
Affected products
- WuzhiCMS WuzhiCMS up to 4.1.0
Timeline
- 2026-09-16: disclosed
- other: Exploit has been published and may be used in the wild