CVE-2025-59055: medium-severity vulnerability in instantsoft icms2
InstantCMS vulnerable to Server-Side Request Forgery via package installer
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.5%
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
instantsoft · icms2Related CVEs — instantsoft icms2
In the same product, most dangerous first.
CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2026-54611MEDIUMInstantCMS has Remote Code Execution in package installerEPSS 0.7%CVE-2024-31213LOWInstantCMS Open Redirect vulnerabilityEPSS 0.4%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-48707LOWInstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanningEPSS 0.3%CVE-2026-28281HIGHInstantCMS has Multiple CSRF VulnerabilitiesEPSS 0.2%