---
id: "CVE-2026-116094"
kind: "vulnerability"
aliases: ["CVE-2026-116094"]
title: "EyouCMS: remote_file_to_local lets attackers force server-side requests"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["eyoucms", "other", "php", "self-hosted"]
not_affected_if: ["fixed-version", "not-eyoucms"]
published_at: "2026-10-25T22:16:29+00:00"
first_seen_at: "2026-10-25T22:36:03+00:00"
updated_at: "2026-10-25T22:36:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116094", "first_seen_at": "2026-10-25T22:36:03+00:00"}]
---

# EyouCMS: remote_file_to_local lets attackers force server-side requests

EyouCMS up to 1.8.3 has a flaw in the remote_file_to_local function in application/function.php. A remote attacker can make the server send requests to addresses of the attacker's choice, which is server-side request forgery.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EyouCMS version in the admin panel or the project files; versions up to `1.8.3` are reported affected
- Look for the function `remote_file_to_local` in `application/function.php` and check whether it fetches user-supplied URLs
- unknown whether a fixed version exists

## Fix

- unknown: the sources do not name a fixed version
- Restrict outbound requests from the web server to internal addresses and metadata endpoints until a patch is available
- Disable or remove any feature that calls remote_file_to_local with user-supplied URLs

## Timeline

- 2026-10-25T22:36:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116094

## From the sources

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_