CVE-2026-85380: light0011 cms UEditor controller.php catchimage server-side request forgery
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source[] causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction, according to the supplied CVSS vector. An attacker manipulates the source[] argument handled by the catchimage function in Public/ueditor/php/controller.php.
How likely is exploitation?
Public exploit code is available, and the vulnerability is rated high severity with low attack complexity. This makes exposed instances a practical target for remote attacks.
Which releases should be considered affected?
Specific affected and fixed release versions are not available because the product uses a rolling-release update model. Treat deployments containing the identified UEditor controller.php catchimage functionality as potentially affected until the project provides remediation information.
Is an official fix available?
The project was notified through an issue report but had not responded at the time of the provided information. No patched release or vendor mitigation is identified.