CVE-2026-79425
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
Risk Assessment
An authenticated attacker can exploit the SSRF vulnerability to scan and access internal resources, potentially leading to disclosure of infrastructure information or further exploitation of internal services. The risk is limited to authenticated accounts.
Recommendation
Update CRMEB to a version that fixes this vulnerability, or implement validation and restrictions for URLs used in the /adminapi/file/online_upload component. Consider blocking requests to internal resources at the network level.
Other vulnerabilities in CRMEB
See all- CVE-2023-30185Critical
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
- CVE-2020-25466Critical
An SSRF vulnerability in the downloadimage interface of CRMEB 3.0 allows remote attackers to download arbitrary files from the server and execute arbitrary code remotely.
- CVE-2026-79426High
In CRMEB v6.0.0, there is an arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component. An authenticated attacker can delete arbitrary files via a crafted POST request.
- CVE-2026-85212High
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
- CVE-2026-85177Medium
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
Original NVD description (English source)
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS