Vulnerability-Lookup

CVE-2026-33486 (GCVE-0-2026-33486)

Vulnerability from cvelistv5 – Published: 2026-03-26 17:15 – Updated: 2026-03-26 18:47

Title

Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Summary

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-26 18:47 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7681 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/roadiz/core-bundle-dev-app/sec…	x_refsource_CONFIRM
https://github.com/roadiz/core-bundle-dev-app/com…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
roadiz	core-bundle-dev-app	Affected: >= 2.7.0, < 2.7.9 Affected: >= 2.6.0, < 2.6.28 Affected: >= 2.4.0, < 2.5.44 Affected: < 2.3.42	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33486",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T18:47:20.504405Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T18:47:26.997Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core-bundle-dev-app",
          "vendor": "roadiz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.7.0, \u003c 2.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.6.0, \u003c 2.6.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.4.0, \u003c 2.5.44"
            },
            {
              "status": "affected",
              "version": "\u003c 2.3.42"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server\u0027s local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:15:31.073Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"
        },
        {
          "name": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
        }
      ],
      "source": {
        "advisory": "GHSA-rc55-58f4-687g",
        "discovery": "UNKNOWN"
      },
      "title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33486",
    "datePublished": "2026-03-26T17:15:31.073Z",
    "dateReserved": "2026-03-20T16:16:48.971Z",
    "dateUpdated": "2026-03-26T18:47:26.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33486",
      "date": "2026-10-18",
      "epss": "0.00403",
      "percentile": "0.33036"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "core-bundle-dev-app",
                "vendor": "roadiz",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.7.0, \u003c 2.7.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.6.0, \u003c 2.6.28"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.4.0, \u003c 2.5.44"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 2.3.42"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B54B795E-2244-402F-80D7-B2AE64ADB6FC",
                    "versionEndExcluding": "2.3.42",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "797A6BCB-ACEE-49D0-A3F5-8D67FEE92A94",
                    "versionEndExcluding": "2.5.44",
                    "versionStartIncluding": "2.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2541EE20-EDA5-434A-A201-9979927BA219",
                    "versionEndExcluding": "2.6.28",
                    "versionStartIncluding": "2.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C506359-4F7E-47A5-9A30-39948ABEAA5C",
                    "versionEndExcluding": "2.7.9",
                    "versionStartIncluding": "2.7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server\u0027s local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."
          },
          {
            "lang": "es",
            "value": "Roadiz es un sistema de gesti\u00f3n de contenido polim\u00f3rfico basado en un sistema de nodos que puede manejar muchos tipos de servicios. Una vulnerabilidad en roadiz/documents anterior a las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 permite a un atacante autenticado leer cualquier archivo en el sistema de archivos local del servidor al que el proceso del servidor web tiene acceso, incluyendo variables de entorno altamente sensibles, credenciales de base de datos y archivos de configuraci\u00f3n internos. Las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 contienen un parche."
          }
        ],
        "id": "CVE-2026-33486",
        "lastModified": "2026-06-17T10:37:34.913",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-33486",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T18:47:20.504405Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-03-26T18:16:29.903",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T22:51:27+00:00",
      "cve": "CVE-2026-33486",
      "id": "CVE-2026-33486",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33486.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-33486",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-03-26T18:47:20.504405Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-03-26T18:47:24.111Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "core-bundle-dev-app",
              "vendor": "roadiz",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.7.0, \u003c 2.7.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.6.0, \u003c 2.6.28"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.4.0, \u003c 2.5.44"
                },
                {
                  "status": "affected",
                  "version": "\u003c 2.3.42"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server\u0027s local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-03-26T17:15:31.073Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"
            },
            {
              "name": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
            }
          ],
          "source": {
            "advisory": "GHSA-rc55-58f4-687g",
            "discovery": "UNKNOWN"
          },
          "title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-33486",
        "datePublished": "2026-03-26T17:15:31.073Z",
        "dateReserved": "2026-03-20T16:16:48.971Z",
        "dateUpdated": "2026-03-26T18:47:26.997Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33486

Vulnerability from fkie_nvd - Published: 2026-03-26 18:16 - Updated: 2026-06-17 10:37

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2	Patch
	security-advisories@github.com	https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g	Exploit, Vendor Advisory

Impacted products

Vendor	Product	Version
roadiz	core-bundle-dev-app	*
roadiz	core-bundle-dev-app	*
roadiz	core-bundle-dev-app	*
roadiz	core-bundle-dev-app	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "core-bundle-dev-app",
          "vendor": "roadiz",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.7.0, \u003c 2.7.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.6.0, \u003c 2.6.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.4.0, \u003c 2.5.44"
            },
            {
              "status": "affected",
              "version": "\u003c 2.3.42"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B54B795E-2244-402F-80D7-B2AE64ADB6FC",
              "versionEndExcluding": "2.3.42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "797A6BCB-ACEE-49D0-A3F5-8D67FEE92A94",
              "versionEndExcluding": "2.5.44",
              "versionStartIncluding": "2.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2541EE20-EDA5-434A-A201-9979927BA219",
              "versionEndExcluding": "2.6.28",
              "versionStartIncluding": "2.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C506359-4F7E-47A5-9A30-39948ABEAA5C",
              "versionEndExcluding": "2.7.9",
              "versionStartIncluding": "2.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server\u0027s local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."
    },
    {
      "lang": "es",
      "value": "Roadiz es un sistema de gesti\u00f3n de contenido polim\u00f3rfico basado en un sistema de nodos que puede manejar muchos tipos de servicios. Una vulnerabilidad en roadiz/documents anterior a las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 permite a un atacante autenticado leer cualquier archivo en el sistema de archivos local del servidor al que el proceso del servidor web tiene acceso, incluyendo variables de entorno altamente sensibles, credenciales de base de datos y archivos de configuraci\u00f3n internos. Las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 contienen un parche."
    }
  ],
  "id": "CVE-2026-33486",
  "lastModified": "2026-06-17T10:37:34.913",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33486",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-26T18:47:20.504405Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-26T18:16:29.903",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RC55-58F4-687G

Vulnerability from github – Published: 2026-03-23 21:43 – Updated: 2026-03-27 21:00

Summary

Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Details

This vulnerability allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files.

Field	Details
Vulnerability Class	Server-Side Request Forgery (SSRF) & Local File Inclusion (LFI)
Affected Component	`RZ\Roadiz\Documents\DownloadedFile::fromUrl()`
Prerequisites	Authenticated user with `ROLE_ACCESS_DOCUMENTS`

Technical Description

The Roadiz backend features tools for importing external media, such as compiling cover art from Podcast RSS Feeds or OEmbed providers. This feature is handled by various MediaFinders, which ultimately pass the extracted media URLs to the DownloadedFile::fromUrl(string $url) parsing mechanism.

Inside fromUrl(), the application uses PHP's native fopen() function to fetch the remote resource and copy it into the local temporary directory before injecting it into the Flysystem Documents storage.

The Flaw

The $url parameter is passed to fopen without any schema validation or sanitization. In PHP, when stream wrappers are enabled, functions like fopen do not restrict operations to HTTP streams. If a file:// scheme is supplied, PHP seamlessly converts the operation into a local file system read. Because an attacker tightly controls the XML feed (e.g., from a Podcast integration), they can inject a file:// URI, forcing the CMS to "download" internal system files directly into the publicly accessible Media Library.

Proof of Concept (PoC)

To reliably reproduce this vulnerability without requiring a live external URL, the attacker simply mimics the behavior of the Podcast importer manipulating the internal system.

Step 1: Craft the Malicious Payload

The attacker creates a standard Podcast RSS XML feed (podcast.xml) and hosts it externally (or on an internal network reachable by the CMS). Inside this XML, the href attribute for the podcast thumbnail is weaponized to target a sensitive system file:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">
  <channel>
    <title>Roadiz LFI Exploit</title>
    <!-- Payload triggers the local filesystem fetch via PHP streams -->
    <itunes:image href="file:///app/.env" /> 
  </channel>
</rss>

Step 2: Exploit the CMS

Authenticate to the Roadiz Backoffice.
Navigate to Documents (Media Manager).
Select Add a document -> Import from URL (or trigger a Podcast sync).
Supply the URL of the malicious podcast.xml file.

Step 3: Extract the Data

The AbstractPodcastFinder processes the XML and feeds file:///app/.env directly into DownloadedFile::fromUrl().
The Roadiz application silently reads its own .env file, creating a new "Document" arrayed with the contents of the file.
The file manifests in the Media Manager grid as a broken image icon.
The attacker actively downloads the newly generated Document from the dashboard, successfully extracting the framework's internal API keys, database credentials, and APP_SECRET.

Impact Analysis

Exploitation of this vulnerability results in a total loss of Confidentiality for the web application and underlying operating system.

Application Compromise: An attacker can retrieve .env, security.yaml, or database .sqlite files, leading to complete horizontal and vertical privilege escalation.
System Enumeration: The attacker can read /etc/passwd, enumerating system users in preparation for lateral movement.
Cloud Environment Compromise: If deployed within AWS, Azure, or GCP, the SSRF vector can be pivoted to read internal cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), allowing the attacker to steal Root IAM roles globally compromising the victim's infrastructure.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "roadiz/documents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "roadiz/documents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "roadiz/documents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.5.44"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "roadiz/documents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.42"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-23T21:43:14Z",
    "nvd_published_at": "2026-03-26T18:16:29Z",
    "severity": "MODERATE"
  },
  "details": "This vulnerability allows an authenticated attacker to read any file on the server\u0027s local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files.\n\n| Field | Details |\n| :--- | :--- |\n| **Vulnerability Class** | Server-Side Request Forgery (SSRF) \u0026 Local File Inclusion (LFI) |\n| **Affected Component** | `RZ\\Roadiz\\Documents\\DownloadedFile::fromUrl()` |\n| **Prerequisites** | Authenticated user with `ROLE_ACCESS_DOCUMENTS` |\n\n## Technical Description\n\nThe Roadiz backend features tools for importing external media, such as compiling cover art from Podcast RSS Feeds or OEmbed providers. This feature is handled by various `MediaFinders`, which ultimately pass the extracted media URLs to the `DownloadedFile::fromUrl(string $url)` parsing mechanism.\n\nInside `fromUrl()`, the application uses PHP\u0027s native `fopen()` function to fetch the remote resource and copy it into the local temporary directory before injecting it into the Flysystem Documents storage.\n\n##  The Flaw\n\nThe `$url` parameter is passed to `fopen` *without any schema validation or sanitization*. In PHP, when stream wrappers are enabled, functions like `fopen` do not restrict operations to HTTP streams. If a `file://` scheme is supplied, PHP seamlessly converts the operation into a local file system read. Because an attacker tightly controls the XML feed (e.g., from a Podcast integration), they can inject a `file://` URI, forcing the CMS to \"download\" internal system files directly into the publicly accessible Media Library.\n\n---\n\n## Proof of Concept (PoC)\n\nTo reliably reproduce this vulnerability without requiring a live external URL, the attacker simply mimics the behavior of the Podcast importer manipulating the internal system.\n\n### Step 1: Craft the Malicious Payload\nThe attacker creates a standard Podcast RSS XML feed (`podcast.xml`) and hosts it externally (or on an internal network reachable by the CMS). Inside this XML, the `href` attribute for the podcast thumbnail is weaponized to target a sensitive system file:\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003crss version=\"2.0\" xmlns:itunes=\"http://www.itunes.com/dtds/podcast-1.0.dtd\"\u003e\n  \u003cchannel\u003e\n    \u003ctitle\u003eRoadiz LFI Exploit\u003c/title\u003e\n    \u003c!-- Payload triggers the local filesystem fetch via PHP streams --\u003e\n    \u003citunes:image href=\"file:///app/.env\" /\u003e \n  \u003c/channel\u003e\n\u003c/rss\u003e\n```\n\n### Step 2: Exploit the CMS\n1. Authenticate to the Roadiz Backoffice.\n2. Navigate to **Documents (Media Manager)**.\n3. Select **Add a document** -\u003e **Import from URL** (or trigger a Podcast sync).\n4. Supply the URL of the malicious `podcast.xml` file.\n\n### Step 3: Extract the Data\n1. The `AbstractPodcastFinder` processes the XML and feeds `file:///app/.env` directly into `DownloadedFile::fromUrl()`.\n2. The Roadiz application silently reads its own `.env` file, creating a new \"Document\" arrayed with the contents of the file.\n3. The file manifests in the Media Manager grid as a broken image icon.\n4. The attacker actively downloads the newly generated Document from the dashboard, successfully extracting the framework\u0027s internal API keys, database credentials, and `APP_SECRET`.\n\n---\n\n## Impact Analysis\n\nExploitation of this vulnerability results in a total loss of **Confidentiality** for the web application and underlying operating system. \n\n- **Application Compromise:** An attacker can retrieve `.env`, `security.yaml`, or database `.sqlite` files, leading to complete horizontal and vertical privilege escalation.\n- **System Enumeration:** The attacker can read `/etc/passwd`, enumerating system users in preparation for lateral movement.\n- **Cloud Environment Compromise:** If deployed within AWS, Azure, or GCP, the SSRF vector can be pivoted to read internal cloud metadata endpoints (e.g., `http://169.254.169.254/latest/meta-data/`), allowing the attacker to steal Root IAM roles globally compromising the victim\u0027s infrastructure.",
  "id": "GHSA-rc55-58f4-687g",
  "modified": "2026-03-27T21:00:11Z",
  "published": "2026-03-23T21:43:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/roadiz/core-bundle-dev-app"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-33486 (GCVE-0-2026-33486)

FKIE_CVE-2026-33486

GHSA-RC55-58F4-687G

Technical Description

The Flaw

Proof of Concept (PoC)

Step 1: Craft the Malicious Payload

Step 2: Exploit the CMS

Step 3: Extract the Data

Impact Analysis

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour