PT-2025-37258 · Unknown · Instantcms

Szczurowsky + 1 · Published 2025-09-11 · Updated 2025-09-24 · CVE-2025-59055

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: InstantCMS versions through 2.17.3

Description: InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability exists that allows authenticated remote attackers to make arbitrary HTTP/HTTPS requests via the package parameter. This is possible within the installer functionality. Exploitation can lead to scanning the local network, calling local services and their functions, conducting a Denial-of-Service (DoS) attack, and disclosing a server's real IP address if it is behind a reverse proxy. It is also possible to exhaust server resources by sending numerous requests.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59055

GHSA-79HH-MHVG-WHRW

Affected Products

Instantcms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59055.json · Exploit
• https://github.com/instantsoft/icms2/commit/fa997bdab3429fad0c850966bfacbcb96d5ab041 · Patch
• https://github.com/instantsoft/icms2/security/advisories/GHSA-79hh-mhvg-whrw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59055 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59055 · Vendor Advisory
• https://t.me/cveNotify/136263 · Telegram Post
• https://twitter.com/CVEnew/status/1966225702078107768 · Twitter Post
• https://twitter.com/NightfallCVE/status/1970937980069216749 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1966372828137005308 · Twitter Post