CVE-2026-40500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40500", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "REJECTED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-13T20:29:02.808Z", "datePublished": "2026-04-15T21:25:53.214Z", "dateUpdated": "2026-07-09T22:59:18.996Z", "dateRejected": "2026-07-09T22:59:18.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-09T22:59:18.996Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The \"Add Module from URL\" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The \"Add Module from URL\" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.</p>"}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40500", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "REJECTED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-13T20:29:02.808Z", "datePublished": "2026-04-15T21:25:53.214Z", "dateUpdated": "2026-07-09T22:59:18.996Z", "dateRejected": "2026-07-09T22:59:18.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-09T22:59:18.996Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The \"Add Module from URL\" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The \"Add Module from URL\" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.</p>"}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The \"Add Module from URL\" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable."}], "id": "CVE-2026-40500", "lastModified": "2026-07-09T23:17:05.123", "metrics": {}, "published": "2026-04-15T22:17:22.377", "references": [], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Rejected"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.255]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "processwire", "source": "cna", "vendor": "processwire"}, "product": "processwire", "vendor": "processwire"}], "analysis": {"en": {"generated_at": "2026-04-16T02:18:46.104970+00:00", "value": {"mitigation_remediation": ["Upgrade ProcessWire to version 3.0.256 or later where the SSRF issue is fixed.", "If upgrading is not immediately possible, disable the \"Add Module From URL\" capability or remove the corresponding permission from administrative roles.", "Restrict administrative access to trusted IP addresses and monitor for unexpected outbound HTTP traffic from the CMS server."], "summary": {"action": "Immediate Patch", "impact": "Server\u2011Side Request Forgery that enables authenticated administrators to trigger outbound HTTP requests to arbitrary URLs, allowing internal network scanning and potential access to cloud metadata endpoints."}, "threat_synthesis": {"affected_systems": "The vulnerability affects ProcessWire CMS, version 3.0.255 and all earlier releases. Any installation that allows administrators to use the \"Add Module From URL\" function is susceptible.", "description_and_impact": "ProcessWire CMS versions 3.0.255 and earlier contain an SSRF vulnerability in the admin panel\u2019s \"Add Module From URL\" feature. By providing arbitrary URLs to the module download parameter, an authenticated administrator can cause the server to issue outbound HTTP requests to attacker\u2011controlled internal or external hosts. The feature\u2019s error messages reveal whether hosts are reachable, enabling reliable internal network port scanning and host enumeration across RFC\u20111918 ranges, and exposing sensitive information such as cloud instance metadata.", "risk_and_exploitability": "The CVSS score is 6.1, indicating Moderate severity. EPSS is not available and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires administrative authentication and the ability to use the module import feature. Once authenticated, an attacker can perform internal reconnaissance or obtain privileged metadata without needing external network access."}}}}, "created": "2026-04-15T22:30:15.946512+00:00", "updated": "2026-04-16T02:30:21.677897+00:00", "vendors": ["processwire", "processwire$PRODUCT$processwire"]}