CVE-2026-92380

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1

Description A server-side request forgery (SSRF) exists in the Remote Image Fetch component. This occurs when the ckditor::saveRemote() function in the coreframe/app/attachment/index.php file improperly handles the source[] argument, allowing a remote attacker to initiate unauthorized requests from the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ckditor::saveRemote() function to minimize the risk of exploitation.