PT-2026-27283 · Roadiz · Roadiz

Rocmertakdag · Published 2026-03-23 · Updated 2026-03-26 · CVE-2026-33486

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Roadiz versions prior to 2.7.9 Roadiz versions prior to 2.6.28 Roadiz versions prior to 2.5.44 Roadiz versions prior to 2.3.42

Description Roadiz is a polymorphic content management system based on a node system. A flaw in the RZRoadizDocumentsDownloadedFile::fromUrl() function allows an authenticated attacker with ROLE ACCESS DOCUMENTS privileges to read any file on the server's local file system that the web server process has access to. This includes sensitive data like environment variables, database credentials, and internal configuration files. The issue arises because the application uses PHP's fopen() function without proper validation or sanitization of the URL parameter, allowing the use of the file:// stream wrapper to access local files. An attacker can exploit this by crafting a malicious XML feed, such as a Podcast RSS feed, with a file:// URI pointing to a sensitive system file. This forces the CMS to read the internal file and make it available as a downloadable document within the Media Manager. Exploitation can lead to a total loss of confidentiality for the web application and underlying operating system, potentially enabling application compromise, system enumeration, and cloud environment compromise.

Recommendations Versions prior to 2.7.9: Upgrade to version 2.7.9 or later. Versions prior to 2.6.28: Upgrade to version 2.6.28 or later. Versions prior to 2.5.44: Upgrade to version 2.5.44 or later. Versions prior to 2.3.42: Upgrade to version 2.3.42 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33486

GHSA-RC55-58F4-687G

Affected Products

Roadiz

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33486.json · Exploit
• https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2 · Patch
• https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rc55-58f4-687g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33486 · Security Note
• https://github.com/roadiz/core-bundle-dev-app · Note
• https://reddit.com/r/VulnMatter/comments/1s2f6l7/resumen_diario_de_vulnerabilidades_24032026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2037281354828730696 · Twitter Post
• https://twitter.com/CVEnew/status/2037280608368681325 · Twitter Post