CVE-2026-85380: Server-Side Request Forgery in light0011 cms

This vulnerability exists in the catchimage function of the UEditor component within light0011 cms. By manipulating the source[] argument, an attacker can trigger server-side request forgery, potentially causing the server to make unintended HTTP requests. The vulnerability can be exploited remotely without authentication. The product’s rolling release model means no fixed or affected versions are specified. The vendor has not yet issued a response or patch. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary HTTP requests from the affected server, potentially accessing internal resources or services not otherwise reachable. The vulnerability does not require authentication and can be triggered remotely. The CVSS score of 6.9 indicates a medium severity impact, with low to limited confidentiality, integrity, and availability impact as per the CVSS vector.

No official fix or patch has been released by the vendor as of the current information. Since the vendor has not responded yet, users should monitor the vendor’s channels for updates. Until a patch is available, consider restricting outbound HTTP requests from the server or implementing network-level controls to limit SSRF impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.