Executive Summary
CVE-2026-116094 is a server-side request forgery (SSRF) vulnerability in EyouCMS versions up to 1.8.3. The flaw sits in the remote_file_to_local function in application/function.php. NVD lists a CVSS score of 7.3 and notes the attack can be launched remotely.
According to the NVD entry, the exploit has been publicly disclosed and may be used by attackers.
Vulnerability Details
| Field | Value |
|---|---|
| CVE | CVE-2026-116094 |
| Product | EyouCMS |
| Affected versions | 1.8.3 and earlier |
| Component | remote_file_to_local in application/function.php |
| Weakness | Server-side request forgery |
| Attack vector | Remote |
| CVSS | 7.3 |
| Published | 2026-10-25 |
The function is designed to download a remote file to the local server. Manipulating its input causes the server to issue requests to attacker-chosen locations.
Impact
SSRF in a CMS typically lets an attacker:
- Probe internal hosts and ports that are not reachable from the internet
- Reach cloud metadata endpoints and other internal-only services
- Pull attacker-controlled content onto the server, which can chain into further attacks
The exact reach depends on how the site is hosted and what the web server can talk to.
Remediation
- Check the EyouCMS project for a release newer than 1.8.3 and upgrade when one is available. At the time of writing, the NVD entry does not point to a fixed version.
- Restrict outbound traffic from the web server so it cannot reach internal ranges or metadata endpoints.
- Put a WAF rule in front of the site to block requests that pass internal or loopback URLs to file-fetch parameters.
- Review web server and access logs for unusual requests that trigger remote fetches.