CVE-2026-25870 DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF
An attacker can exploit SSRF in DoraCMS UEditor to scan internal networks or cause denial of service via resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25870?
CVE-2026-25870 is a medium-severity server-side request forgery vulnerability in doramart DoraCMS, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without sufficient validation or destination restrictions. The implementation does not enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. An attacker can abuse this behavior to induce the server to issue outbound requests to arbitrary hosts, including internal network resources, potentially enabling internal network scanning and denial of service through resource exhaustion.
Weakness: CWE-918
Which versions are affected by CVE-2026-25870?
How do I fix CVE-2026-25870?
No fix has been published for CVE-2026-25870 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-25870 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25870 exists.
Sources
Also known as GHSA-22v2-wj2v-mmrw.