PT-2026-41339 · Couchcms · Couchcms

Xxcdd · Published 2026-05-15 · Updated 2026-05-15 · CVE-2021-47958

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-47958

Affected Products

Couchcms

References · 4

• 🔥 https://exploit-db.com/exploits/49675 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47958 · Security Note
• https://github.com/CouchCMS/CouchCMS · Note
• https://vulncheck.com/advisories/couchcms-server-side-request-forgery-via-svg-upload · Note