Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 HIGH: CVE-2026-92380 (CVSS 7.3) - SSRF vulnerability in WuzhiCMS ≤4.1.0 via ckditor::saveRemote function. Remotely exploitable, exploit code public. Vendor unresponsive. Patch/mitigate immediately. #CVE #Vulnerability #PatchNow https://t.co/PPGqcUthZQ