CVE-2026-25870 is a server-side request forgery (SSRF) vulnerability in DoraCMS up to version 3.1, specifically in the UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs HTTP/HTTPS requests on the server side without enforcing allowlists, blocking internal/private IP ranges, or applying request timeouts and response size limits. This allows attackers to induce the server to send requests to arbitrary hosts, including internal network resources, which may be leveraged for internal network reconnaissance or denial of service through resource exhaustion.

An attacker can exploit this SSRF vulnerability to make the DoraCMS server send requests to arbitrary external or internal network hosts. This can lead to unauthorized internal network scanning and potential denial of service conditions caused by resource exhaustion on the server. There is no indication of direct code execution or data leakage beyond the SSRF impact described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting the UEditor remote image fetch functionality or implementing network-level controls to prevent unauthorized outbound requests from the server. Monitoring and restricting server outbound traffic to trusted destinations may help mitigate exploitation risk.