CVE-2026-93506— SveltyCMS File Upload Endpoint upload-media server-side request forgery
Quick assessment
Affected
n/a SveltyCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be laun
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93506
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SveltyCMS File Upload Endpoint upload-media server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | SveltyCMS | 0.0.6 |
cpe:2.3:a:sveltycms:sveltycms:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-93506
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93506
请登录查看更多情报信息。
Other References for CVE-2026-93506 (1)
Same Patch Batch · n/a · 2026-09-18 · 7 CVEs total
| CVE-2026-93331 | 7.3 HIGH | GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds |
| CVE-2026-93504 | 6.3 MEDIUM | SveltyCMS User Attribute Update Endpoint +server.ts access control |
| CVE-2026-93505 | 3.5 LOW | SveltyCMS SVG Media Upload media-service.server.ts cross site scripting |
| CVE-2026-88623 | NUUO NVR 2.0.0 任意文件读取漏洞 | |
| CVE-2026-88622 | NUUO NVR 2.0.0命令注入漏洞 | |
| CVE-2026-79294 | Kimi 2026-07-18版 HTML预览XSS漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-93505
SveltyCMS SVG Media Upload media-service.server.ts cross sit -
CVE-2026-93504
SveltyCMS User Attribute Update Endpoint +server.ts access c -
CVE-2026-93331
GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt o -
CVE-2026-88623
NUUO NVR 2.0.0 任意文件读取漏洞 -
CVE-2026-88622
NUUO NVR 2.0.0命令注入漏洞
Same weakness: CWE-918
-
CVE-2026-62282
OpenCVE: Server-Side Request Forgery (SSRF) in notifications -
CVE-2026-93597
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses -
CVE-2026-40537
群晖DSM PersonMail API SSRF漏洞 -
CVE-2026-67101
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-12106
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) S
V. Comments for CVE-2026-93506
No comments yet