CVE-2026-25870 Details

A server-side request forgery (SSRF) vulnerability exists in DoraCMS versions through 3.1, specifically within the UEditor integration for remote image fetching. The vulnerability arises because the application accepts user-provided URLs and makes server-side HTTP or HTTPS requests without adequate validation or restrictions on the destination. The implementation fails to enforce allowlists, block internal or private IP address ranges, or apply request timeouts or response size limits. This lack of control allows attackers to manipulate the server into making outbound requests to arbitrary hosts, including internal network resources. Such exploitation could facilitate internal network scanning and cause denial-of-service conditions through resource exhaustion.

It is recommended to allowlist trusted hosts for remote fetching, restricting requests to a known set of domains. If the endpoint is publicly accessible, consider implementing authentication or access controls.