FKIE_CVE-2026-18856

Vulnerability from fkie_nvd - Published: 2026-08-05 01:16 - Updated: 2026-10-23 21:10
Severity
4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Summary
A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.34 will fix this issue. It is recommended to upgrade the affected component.
References
cna@vuldb.comhttps://github.com/MCzhao2006/Rhymix-SSRF-Report
cna@vuldb.comhttps://rhymix.org/files/attach/releases/rhymix-2.1.34.zip
cna@vuldb.comhttps://rhymix.org/news/1948042
cna@vuldb.comhttps://vuldb.com/cve/CVE-2026-18856
cna@vuldb.comhttps://vuldb.com/submit/858471
cna@vuldb.comhttps://vuldb.com/vuln/385868
cna@vuldb.comhttps://vuldb.com/vuln/385868/cti
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:poesis:rhymix_cms:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Data Import Module"
          ],
          "product": "Rhymix CMS",
          "vendor": "Poesis",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.0"
            },
            {
              "status": "affected",
              "version": "2.1.1"
            },
            {
              "status": "affected",
              "version": "2.1.2"
            },
            {
              "status": "affected",
              "version": "2.1.3"
            },
            {
              "status": "affected",
              "version": "2.1.4"
            },
            {
              "status": "affected",
              "version": "2.1.5"
            },
            {
              "status": "affected",
              "version": "2.1.6"
            },
            {
              "status": "affected",
              "version": "2.1.7"
            },
            {
              "status": "affected",
              "version": "2.1.8"
            },
            {
              "status": "affected",
              "version": "2.1.9"
            },
            {
              "status": "affected",
              "version": "2.1.10"
            },
            {
              "status": "affected",
              "version": "2.1.11"
            },
            {
              "status": "affected",
              "version": "2.1.12"
            },
            {
              "status": "affected",
              "version": "2.1.13"
            },
            {
              "status": "affected",
              "version": "2.1.14"
            },
            {
              "status": "affected",
              "version": "2.1.15"
            },
            {
              "status": "affected",
              "version": "2.1.16"
            },
            {
              "status": "affected",
              "version": "2.1.17"
            },
            {
              "status": "affected",
              "version": "2.1.18"
            },
            {
              "status": "affected",
              "version": "2.1.19"
            },
            {
              "status": "affected",
              "version": "2.1.20"
            },
            {
              "status": "affected",
              "version": "2.1.21"
            },
            {
              "status": "affected",
              "version": "2.1.22"
            },
            {
              "status": "affected",
              "version": "2.1.23"
            },
            {
              "status": "affected",
              "version": "2.1.24"
            },
            {
              "status": "affected",
              "version": "2.1.25"
            },
            {
              "status": "affected",
              "version": "2.1.26"
            },
            {
              "status": "affected",
              "version": "2.1.27"
            },
            {
              "status": "affected",
              "version": "2.1.28"
            },
            {
              "status": "affected",
              "version": "2.1.29"
            },
            {
              "status": "affected",
              "version": "2.1.30"
            },
            {
              "status": "affected",
              "version": "2.1.31"
            },
            {
              "status": "affected",
              "version": "2.1.32"
            },
            {
              "status": "affected",
              "version": "2.1.33"
            },
            {
              "status": "unaffected",
              "version": "2.1.34"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.34 will fix this issue. It is recommended to upgrade the affected component."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue determinada en Poesis Rhymix CMS hasta 2.1.33. Esto impacta la funci\u00f3n procImporterAdminCheckXmlFile del archivo modules/importer/importer.admin.controller.php del componente M\u00f3dulo de Importaci\u00f3n de Datos. Esta manipulaci\u00f3n del argumento filename causa falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque es posible de ser llevado a cabo remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Actualizar a la versi\u00f3n 2.1.34 solucionar\u00e1 este problema. Se recomienda actualizar el componente afectado."
    }
  ],
  "id": "CVE-2026-18856",
  "lastModified": "2026-10-23T21:10:00.157",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "MULTIPLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.4,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18856",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-05T16:19:26.715375Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-05T01:16:44.757",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/MCzhao2006/Rhymix-SSRF-Report"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://rhymix.org/files/attach/releases/rhymix-2.1.34.zip"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://rhymix.org/news/1948042"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/cve/CVE-2026-18856"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/submit/858471"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/385868"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/385868/cti"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.