CVE-2025-59055

InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

EPSS

0.45% chance of exploitation in the next 30 days, 38th percentile

Published

2025-09-11

Proof-of-concept exploits (1)

• instantsoft/icms2/security/advisories/GHSA-79hh-mhvg-whrw

References

• CVE Record
• NVD entry

Related

• CVE-2018-14382
• CVE-2024-31212
• CVE-2024-31213
• CVE-2025-59050
• CVE-2025-59057
• CVE-2025-5905