CVE-2026-40500 Details

A server-side request forgery (SSRF) vulnerability has been identified in ProcessWire CMS versions through 3.0.255. This vulnerability resides in the admin panel's 'Add Module From URL' feature, which allows authenticated administrators to submit arbitrary URLs for module downloads. Exploitation of this vulnerability enables the server to make outbound HTTP requests to internal or external hosts controlled by an attacker. The vulnerability is exacerbated by the presence of detailed error messages that can be used to conduct internal network port scanning, host enumeration within private IP ranges, and access cloud instance metadata endpoints.

To address this vulnerability, administrators should disable the 'Add Module From URL' feature if it is not needed. If the feature must be enabled, it should be restricted to a higher privilege role than standard admin and outbound requests should be allowlisted to trusted domains or IP ranges. Additionally, internal IP ranges should be blocked by validating the resolved IP address of any supplied URL before making the request, rejecting those that resolve to loopback, link-local, or private ranges. Finally, verbose error messages should be suppressed to prevent information leakage.