Vulnerability · Published Oct 25, 2026 · Assigned by VulDB

CVE-2026-116094EyouCMS function.php remote_file_to_local server-side request forgery

High 7.3

In plain English

A high-severity server-side request forgery in EyouCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	EyouCMS	1.8.01.8.11.8.21.8.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-426161 | EyouCMS function.php remote_file_to_local server-side request forgery vdb-entry, technical-description
VDB-426161 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-116094 | CVE Analysis and Report third-party-advisory
Submit #1000661 | 易优CMS EyouCMS 1.8.2 Server-Side Request Forgery third-party-advisory
https://github.com/yy-t1/security-reports/tree/main/web/EyouCMS1.8.2/remote_file_to_local()%E7%BC%BA%E5%A4%B1%20SSRF%20%E6%A0%A1%E9%AA%8C%E5%AF%BC%E8%87%B4%E5%89%8D%E5%8F%B0%20SSRF exploit