Description
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.
INFO
Published Date :
2025-09-11T18:46:29.139Z
Last Modified :
2025-09-11T19:10:51.221Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-59055 vulnerability.
| Vendors | Products |
|---|---|
| Instantcms |
|
| Instantsoft |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-59055.
