Quick answers
- Is CVE-2026-93506 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93506 being exploited in the wild.
- How severe is CVE-2026-93506?
- Medium severity, with a CVSS score of 6.3, published 18 September 2026.
- Which products and versions are affected?
- SveltyCMS 0.0.6.
- Is there a fix for CVE-2026-93506?
- A patch was published on 2026-08-07: Commit 05b4f9efeb79e9d72a693232334d7529687f896f Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93506 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-93506?
- Check whether you run SveltyCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A server-side request forgery (CWE-918) vulnerability exists in the media upload functionality of SveltyCMS 0.0.6, specifically in the /mediagallery/upload-media endpoint's file upload component. The vulnerability stems from insufficient validation of URLs used in remote media operations, allowing attackers to craft malicious requests that trigger the server to fetch from attacker-specified destinations. The fix implemented in commit 05b4f9e introduces strict egress URL validation via `validateEgressUrl()` and `safeFetch()` helpers that explicitly block access to cloud metadata endpoints (169.254.169.254), loopback addresses, RFC1918 private ranges, and DNS rebinding attacks. The attack is network-accessible and requires no authentication, enabling remote exploitation to probe internal infrastructure.
Affected products
- SveltyCMS SveltyCMS 0.0.6
Timeline
- 2026-09-18: disclosed
- 2026-08-07: patched: Commit 05b4f9efeb79e9d72a693232334d7529687f896f