CVE-2026-33486 Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Authenticated attackers can exploit SSRF in Roadiz to read sensitive local files, including credentials and configuration data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33486?
CVE-2026-33486 is a medium-severity server-side request forgery vulnerability in roadiz core-bundle-dev-app, published on 26 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch.
Weakness: CWE-918
Which versions are affected by CVE-2026-33486?
8 open source packages ship an affected version, including roadiz/documents. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
roadiz/documents Packagist | All versions | 2.3.42 |
roadiz/documents Packagist | All versions | 2.3.42 |
roadiz/documents Packagist | From 2.4.0 | 2.5.44 |
roadiz/documents Packagist | From 2.4.0 | 2.5.44 |
roadiz/documents Packagist | From 2.6.0 | 2.6.28 |
roadiz/documents Packagist | From 2.6.0 | 2.6.28 |
2 more packages
roadiz/documents Packagist | From 2.7.0 | 2.7.9 |
roadiz/documents Packagist | From 2.7.0 | 2.7.9 |
Products include Roadiz Core-Bundle-Dev-App.
How do I fix CVE-2026-33486?
Upgrade roadiz/documents to a fixed version for your release line: 2.3.42, 2.5.44, 2.6.28 or 2.7.9.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-33486 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33486 exists.
Sources
Also known as GHSA-rc55-58f4-687g.