CVE-2026-116094 EyouCMS function.php remote_file_to_local server-side request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116094?
CVE-2026-116094 is a medium-severity vulnerability in EyouCMS, published on 25 Oct 2026.
Official description
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-918
Which versions are affected by CVE-2026-116094?
How do I fix CVE-2026-116094?
No fix has been published for CVE-2026-116094 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116094 exists.
Sources
Also known as GHSA-fmmj-g7fc-9hcf.