CriticalCritical vulnerability

CVE-2026-36469 (CVSS 9.1)

NVD · officialPublished Sep 21, 2026Risk 50/100EPSS 0.2%

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).

Technical details

CVSS

9.1

AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source