Live › vulnerability › CVE-2026-116256
Go to dashboardThe image function in the MP module's media proxy (application/mp/controller/Show.php) passes the url argument to a server-side request without proper validation. A remote attacker can make the server fetch internal or arbitrary URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Sites running RhaPHP up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905 that have the MP module's media proxy ( action) exposed. Installations that do not use the MP module or do not expose that route are likely not reachable through this flaw, but the sources do not confirm this.
imageNo product ranges from the sources yet.
application/mp/controller/Show.php file from RhaPHP, using the application/mp module path.image action of the MP module is reachable from outside, for example by requesting it with a url parameter pointing to an external host.7ae639ccf8dcb627faace096d030bd4cb4cfb905 and a rolling release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.