CVE-2026-116094: EyouCMS function.php remote_file_to_local server-side request forgery
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remotefiletolocal of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
EyouCMS versions up to and including 1.8.3 are identified as affected. The available information does not state whether any configuration or deployment condition prevents exposure.
Does exploitation require authentication or user interaction?
No. The severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
Is there public exploit information available?
Yes. The vulnerability information states that an exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information does not identify a fixed version or workaround. It states that the vendor was contacted before disclosure but did not respond.