CVE-2026-79425: SSRF
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send a crafted POST request to the /adminapi/file/online_upload endpoint. The available information does not identify which authenticated roles have access to this endpoint.
What can an attacker do with successful exploitation?
The vulnerability can be used to make the CRMEB server send requests to internal resources, enabling internal network or service scanning from the server's network position.
Which version is identified as affected?
The provided information identifies CRMEB v6.0.0 as affected. It does not provide fixed versions, configuration workarounds, or indicators for determining whether exploitation has occurred.