Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92380

WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92380

Published

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92380

Published

WuzhiCMS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "WuzhiCMS",
                    "versions": [
                        {
                            "version": "4.0",
                            "status": "affected"
                        },
                        {
                            "version": "4.1.0",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:wuzhicms:wuzhicms:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Remote Image Fetch"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON