VulnCheck: disputed

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.

VulnCheck: AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

VulnCheck: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

VulnCheck: CWE-918

VulnCheck: https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82

VulnCheck: https://processwire.com/

VulnCheck: https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url

[{"vendor":"processwire","product":"processwire","defaultStatus":"unknown","repo":"https://github.com/processwire/processwire","versions":[{"version":"0","lessThanOrEqual":"3.0.255","versionType":"semver","status":"affected"}]}]

disputed

{"timestamp":"2026-04-16T13:38:07.616055Z","id":"CVE-2026-40500","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"processwire","product":"processwire","defaultStatus":"unknown","repo":"https://github.com/processwire/processwire","versions":[{"version":"0","lessThanOrEqual":"3.0.255","versionType":"semver","status":"affected"}]}]

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CWE-918

https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82

https://processwire.com/

https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url