CVE-2026-33486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33486", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:16:48.971Z", "datePublished": "2026-03-26T17:15:31.073Z", "dateUpdated": "2026-03-26T18:47:26.997Z"}, "containers": {"cna": {"title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"}, {"name": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2", "tags": ["x_refsource_MISC"], "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"}], "affected": [{"vendor": "roadiz", "product": "core-bundle-dev-app", "versions": [{"version": ">= 2.7.0, < 2.7.9", "status": "affected"}, {"version": ">= 2.6.0, < 2.6.28", "status": "affected"}, {"version": ">= 2.4.0, < 2.5.44", "status": "affected"}, {"version": "< 2.3.42", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:15:31.073Z"}, "descriptions": [{"lang": "en", "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."}], "source": {"advisory": "GHSA-rc55-58f4-687g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:47:20.504405Z", "id": "CVE-2026-33486", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:47:26.997Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33486", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T18:47:20.504405Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:47:24.111Z"}}], "cna": {"title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents", "source": {"advisory": "GHSA-rc55-58f4-687g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "roadiz", "product": "core-bundle-dev-app", "versions": [{"status": "affected", "version": ">= 2.7.0, < 2.7.9"}, {"status": "affected", "version": ">= 2.6.0, < 2.6.28"}, {"status": "affected", "version": ">= 2.4.0, < 2.5.44"}, {"status": "affected", "version": "< 2.3.42"}]}], "references": [{"url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g", "name": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2", "name": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:15:31.073Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33486", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:47:26.997Z", "dateReserved": "2026-03-20T16:16:48.971Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T17:15:31.073Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "core-bundle-dev-app", "vendor": "roadiz", "versions": [{"status": "affected", "version": ">= 2.7.0, < 2.7.9"}, {"status": "affected", "version": ">= 2.6.0, < 2.6.28"}, {"status": "affected", "version": ">= 2.4.0, < 2.5.44"}, {"status": "affected", "version": "< 2.3.42"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*", "matchCriteriaId": "B54B795E-2244-402F-80D7-B2AE64ADB6FC", "versionEndExcluding": "2.3.42", "vulnerable": true}, {"criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*", "matchCriteriaId": "797A6BCB-ACEE-49D0-A3F5-8D67FEE92A94", "versionEndExcluding": "2.5.44", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*", "matchCriteriaId": "2541EE20-EDA5-434A-A201-9979927BA219", "versionEndExcluding": "2.6.28", "versionStartIncluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:roadiz:core-bundle-dev-app:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C506359-4F7E-47A5-9A30-39948ABEAA5C", "versionEndExcluding": "2.7.9", "versionStartIncluding": "2.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."}, {"lang": "es", "value": "Roadiz es un sistema de gesti\u00f3n de contenido polim\u00f3rfico basado en un sistema de nodos que puede manejar muchos tipos de servicios. Una vulnerabilidad en roadiz/documents anterior a las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 permite a un atacante autenticado leer cualquier archivo en el sistema de archivos local del servidor al que el proceso del servidor web tiene acceso, incluyendo variables de entorno altamente sensibles, credenciales de base de datos y archivos de configuraci\u00f3n internos. Las versiones 2.7.9, 2.6.28, 2.5.44 y 2.3.42 contienen un parche."}], "id": "CVE-2026-33486", "lastModified": "2026-06-17T10:37:34.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33486", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T18:47:20.504405Z", "version": "2.0.3"}}]}, "published": "2026-03-26T18:16:29.903", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.7.0,2.7.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.6.0,2.6.28)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.4.0,2.5.44)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "core-bundle-dev-app", "source": "cna", "vendor": "roadiz"}, "product": "core-bundle-dev-app", "vendor": "roadiz"}], "analysis": {"en": {"generated_at": "2026-04-01T06:18:09.907809+00:00", "value": {"mitigation_remediation": ["Upgrade Roadiz to version 2.7.9 or newer, or to 2.6.28+, 2.5.44+, or 2.3.42+ depending on your release line.", "Ensure that only trusted users have authenticated access to document routes and enforce proper authentication controls."], "summary": {"action": "Immediate Patch", "impact": "Confidentiality breach"}, "threat_synthesis": {"affected_systems": "Roadiz core-bundle-dev-app versions prior to 2.7.9, 2.6.28, 2.5.44, and 2.3.42 are affected. The patch was applied in these release versions, eliminating the flaw for newer installations.", "description_and_impact": "Roadiz, a polymorphic content\u2011management system, has an SSRF weakness (CWE\u2011918) in the documents component that allows an authenticated attacker to request any local file the web server process can access. The vulnerability can expose environment variables, database credentials, and other sensitive configuration files, resulting in a confidentiality breach.", "risk_and_exploitability": "The CVSS score of 6.8 indicates moderate severity. EPSS is less than 1\u202f%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and a crafted request to the vulnerable documents route. The likely attack vector appears to be internal to the application, not directly exposed to the network, as the description indicates only authenticated users can trigger the file read path."}}}}, "created": "2026-03-27T08:33:32.974512+00:00", "updated": "2026-04-02T07:56:36.220938+00:00", "vendors": ["roadiz", "roadiz$PRODUCT$core-bundle-dev-app"]}