Description

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

INFO

Published Date :

2026-04-15T21:25:53.214Z

Last Modified :

2026-04-15T21:25:53.214Z

Source :

VulnCheck
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40500 vulnerability.

Vendors Products
Processwire
  • Processwire
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40500.

URL Resource
https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82 cve-icon cve-icon
https://processwire.com/ cve-icon cve-icon
https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact