CVE-2026-48707: low-severity vulnerability in instantsoft icms2
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.1epss 0.3%
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
instantsoft · icms2Related CVEs — instantsoft icms2
In the same product, most dangerous first.
CVE-2024-31212MEDIUMSQL injection in index_chart_data actionEPSS 0.9%CVE-2026-54611MEDIUMInstantCMS has Remote Code Execution in package installerEPSS 0.7%CVE-2025-59055MEDIUMInstantCMS vulnerable to Server-Side Request Forgery via package installerEPSS 0.5%CVE-2024-31213LOWInstantCMS Open Redirect vulnerabilityEPSS 0.4%CVE-2024-50348MEDIUMInstantCMS has a Cross Site Scripting VulnerabilityEPSS 0.3%CVE-2026-28281HIGHInstantCMS has Multiple CSRF VulnerabilitiesEPSS 0.2%