Vulnerability · Published Sep 8, 2026 · Assigned by GitHub_M
CVE-2026-48707InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
Low 3.1
In plain English
A low-severity server-side request forgery in icms2 from instantsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| instantsoft | icms2 | < 2.18.2 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N