CVE-2026-48707
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
| CWE | CWE-918 |
| Vendor | instantsoft |
| Product | icms2 |
| Published | Sep 8, 2026 |
| Last Updated | Sep 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for instantsoft icms2
Be the first to know when new low vulnerabilities affecting instantsoft icms2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
instantsoft / icms2
< 2.18.2