CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
Authenticated attackers can scan internal network services via SSRF in InstantCMS file upload redirect handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48707?
CVE-2026-48707 is a low-severity server-side request forgery vulnerability in instantsoft icms2, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
Weakness: CWE-918
Which versions are affected by CVE-2026-48707?
How do I fix CVE-2026-48707?
No fix has been published for CVE-2026-48707 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-48707 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48707 exists.
Sources
Also known as GHSA-cm47-mwv3-f534.