{"id":"CVE-2026-116094","kind":"vulnerability","aliases":["CVE-2026-116094"],"related":[],"title":"EyouCMS: remote_file_to_local lets attackers force server-side requests","description":"A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"EyouCMS up to 1.8.3 has a flaw in the remote_file_to_local function in application/function.php. A remote attacker can make the server send requests to addresses of the attacker's choice, which is server-side request forgery.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eyoucms","other","php","self-hosted"],"not_affected_if":["fixed-version","not-eyoucms"],"how_to_check":"- Check the installed EyouCMS version in the admin panel or the project files; versions up to `1.8.3` are reported affected\n- Look for the function `remote_file_to_local` in `application/function.php` and check whether it fetches user-supplied URLs\n- unknown whether a fixed version exists","fix":"- unknown: the sources do not name a fixed version\n- Restrict outbound requests from the web server to internal addresses and metadata endpoints until a patch is available\n- Disable or remove any feature that calls remote_file_to_local with user-supplied URLs","status":"open","published_at":"2026-10-25T22:16:29+00:00","first_seen_at":"2026-10-25T22:36:03+00:00","triaged_at":"2026-10-25T22:36:37+00:00","updated_at":"2026-10-25T22:36:37+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T22:36:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version\n- Restrict outbound requests from the web server to internal addresses and metadata endpoints until a patch is available\n- Disable or remove any feature that calls remote_file_to_local with user-supplied URLs","reach":"internet","title":"EyouCMS: remote_file_to_local lets attackers force server-side requests","impact":"medium","summary":"EyouCMS up to 1.8.3 has a flaw in the remote_file_to_local function in application/function.php. A remote attacker can make the server send requests to addresses of the attacker's choice, which is server-side request forgery.","category":"other","nicknames":[],"who_cares":["eyoucms","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Server makes attacker-chosen requests to internal network services","analyst_note":"Confirm which EyouCMS features call remote_file_to_local, whether auth is required, and whether a fixed version exists; check the NVD entry and the vendor or project repository.","how_to_check":"- Check the installed EyouCMS version in the admin panel or the project files; versions up to `1.8.3` are reported affected\n- Look for the function `remote_file_to_local` in `application/function.php` and check whether it fetches user-supplied URLs\n- unknown whether a fixed version exists","needs_analyst":true,"not_affected_if":["not-eyoucms","fixed-version"],"who_is_affected":"Sites running EyouCMS up to 1.8.3 where remote_file_to_local is reachable with a URL an outside user can influence. The sources do not say which features reach this function by default. Sites not running EyouCMS can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":3329,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116094':15A,18A '-2026':14A,17A '1.8.3':28B,72C 'address':51B 'application/function.php':40B,84C 'attack':7A,43B,54B,102C 'choic':56B 'contact':117C 'cve':13A,16A 'determin':67C 'disclos':109C 'disclosur':121C 'earli':118C 'execut':85C 'exploit':105C 'eyoucm':1A,19B,25B,69C 'file':3A,35B,78C,83C 'flaw':31B 'forc':8A 'forgeri':63B,95C 'function':38B,76C 'host':24B 'impact':74C 'launch':100C 'lead':89C 'let':6A 'local':5A,37B,80C 'make':45B 'manipul':87C 'may':111C 'php':21B 'possibl':98C 'public':108C 'remot':2A,34B,42B,77C,103C 'request':12A,49B,62B,94C 'respond':125C 'self':23B 'self-host':22B 'send':48B 'server':10A,47B,60B,92C 'server-sid':9A,59B,91C 'side':11A,61B,93C 'util':113C 'vendor':115C 'vulner':65C 'way':128C","nicknames":[],"mitigations":[],"who_affected":"Sites running EyouCMS up to 1.8.3 where remote_file_to_local is reachable with a URL an outside user can influence. The sources do not say which features reach this function by default. Sites not running EyouCMS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T22:16:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116094","severity":null,"published_at":"2026-10-25T22:16:29+00:00","modified_at":"2026-10-25T22:16:29+00:00","first_seen_at":"2026-10-25T22:36:03+00:00","fetched_at":"2026-10-25T22:36:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}