CVE-2026-48707: InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstantCMSto a version that resolves this vulnerability.Fixed in 2.18.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated InstantCMS user can exploit it through the "upload from URL" functionality. Exploitation requires using an HTTP redirect that leads to a private or internal target address.
Are default deployments affected?
The available data identifies the affected functionality as "upload from URL," but does not state whether it is enabled or accessible in a default configuration. Deployments running versions before 2.18.2 should review whether authenticated users can use this upload method.
What can an attacker do with successful exploitation?
An attacker can cause the server to make requests to internal network services and use this behavior to scan or access those services. The stated impact is limited to confidentiality; no integrity or availability impact is specified.
What should be done if patching cannot happen immediately?
Restrict access to the "upload from URL" feature for authenticated users until an update can be applied. This reduces access to the vulnerable redirect-handling path.
How can I determine whether an installation is affected?
Check the InstantCMS version and whether users can use the "upload from URL" file-upload capability. Versions prior to 2.18.2 are affected; version 2.18.2 contains the fix.