CVE-2026-116256: geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction. An attacker manipulates the url argument handled by the image function in application/mp/controller/Show.php.
Which deployments are affected?
The affected component is the Mp Module Media Proxy in geesondog RhaPHP, for revisions up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Because the product uses a rolling-release model, affected and fixed release version numbers are not available.
Is there evidence that exploitation is practical?
Yes. A public exploit is available and could be used, so exposed instances should be treated as having a practical exploitation risk.
Is a vendor fix available?
The available information does not identify an updated release or vendor-provided fix. The vendor was contacted before disclosure but did not respond.