CVE-2026-4953: mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery
A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4953?
CVE-2026-4953 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2026-4953?
To fix CVE-2026-4953, upgrade mingSoft MCMS to version 5.5.1 or later.
What components are affected by CVE-2026-4953?
CVE-2026-4953 affects the catchImage function in the BaseAction.java file of the Editor Endpoint.
What is the impact of CVE-2026-4953?
The impact of CVE-2026-4953 allows an unauthorized user to escalate privileges and execute restricted actions.
Is CVE-2026-4953 related to any specific versions?
CVE-2026-4953 affects all versions of mingSoft MCMS up to and including 5.5.0.