CVE-2026-48707

    Dashboard / Vulnerabilities / CVE-2026-48707

    CVE-2026-48707

    Published: 8 Sept 2026Last Modified: 13 Sept 2026

    Summary: InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

    Details: InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48707.json, https://github.com/instantsoft/icms2/security/advisories/GHSA-cm47-mwv3-f534, https://nvd.nist.gov/vuln/detail/CVE-2026-48707, https://github.com/instantsoft/icms2/commit/04b8fe0eb75fc5f44eecb15684c7d3660586683d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -04b8fe0eb75fc5f44eecb15684c7d3660586683d

    Affected versions

    2.18.1
    2.18.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-48707 | CVE-DB