Server-Side Request Forgery in DoraCMS UEditor Remote Image Fetch

CVE-2026-25870

What is CVE-2026-25870?

DoraCMS versions prior to 3.1 are susceptible to a remote image fetching vulnerability due to improper validation of user-supplied URLs. This security flaw allows attackers to leverage the server's ability to issue HTTP and HTTPS requests, enabling them to target arbitrary resources, including those within internal networks. The lack of necessary constraints, such as allowlists for destinations, safeguards against internal IP address ranges, and limits on request sizes and timeout periods, creates multiple avenues for potential exploit. As a result, malicious actors can perform internal network scans or potentially overwhelm server resources, leading to service disruptions.

References