Vulnerability · Published Feb 10, 2026 · Assigned by VulnCheck

CVE-2026-25870DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF

Medium 5.8

In plain English

A medium-severity server-side request forgery in DoraCMS from doramart. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.

Affected products (as reported)

Vendor	Product	Versions
doramart	DoraCMS	0 – through 3.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

References

https://github.com/doramart/DoraCMS/issues/268 issue-tracking
https://www.doracms.net/ product
https://www.vulncheck.com/advisories/doracms-ueditor-remote-image-fetch-ssrf third-party-advisory