CVE-2026-48707

LowCVSS 3.1

Published: 08/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

InstantCMS versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php, lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

Risk Assessment

The risk is that SSRF could be used to probe the internal network, potentially leading to disclosure of sensitive data or further attacks.

Recommendation

Update InstantCMS to version 2.18.2 or later and restrict the upload-from-URL feature to trusted users.

Other vulnerabilities in InstantCMS

CVE-2026-54611Medium
InstantCMS prior to version 2.18.2 has a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

Original NVD description (English source)

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS