PT-2026-33179 · Unknown · Processwire Cms

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-40500

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProcessWire CMS versions prior to 3.0.256

Description The admin panel's 'Add Module From URL' feature contains a server-side request forgery (SSRF) issue. This occurs when authenticated administrators provide arbitrary URLs to the module download parameter, leading the server to send outbound HTTP requests to internal or external hosts. By analyzing differentiable error messages, an attacker can perform internal network port scanning, host enumeration across RFC-1918 ranges (private IP address spaces), and potentially access cloud instance metadata endpoints.

Recommendations Update to a version newer than 3.0.255.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40500

GHSA-GMWR-9J4P-96VM

Affected Products

Processwire Cms

References · 8

• 🔥 https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40500 · Security Note
• https://osv.dev/vulnerability/GHSA-gmwr-9j4p-96vm · Vendor Advisory
• https://github.com/processwire/processwire · Note
• https://twitter.com/CVEnew/status/2044701612900577744 · Twitter Post
• https://processwire.com · Note
• https://vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url · Note
• https://twitter.com/VulmonFeeds/status/2044707542798925865 · Twitter Post