---
id: CVE-2026-48707
title: InstantCMS is a free and open source content management system
summary: >-
  InstantCMS is a free and open source content management system. Versions prior
  to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file
  upload functionality (`system/core/uploader.php` at lines 509-532). When the
  "up…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: instantsoft
product: icms2
affected:
  - icms2 < 2.18.2
published: '2026-09-08'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T21:17:10.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48707'
references:
  - url: >-
      https://github.com/instantsoft/icms2/commit/04b8fe0eb75fc5f44eecb15684c7d3660586683d
    label: security-advisories@github.com
  - url: >-
      https://github.com/instantsoft/icms2/security/advisories/GHSA-cm47-mwv3-f534
    label: security-advisories@github.com
  - url: >-
      https://github.com/instantsoft/icms2/security/advisories/GHSA-cm47-mwv3-f534
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T20:50:45.764807Z'
epss: 0.0021
epssPercentile: 0.11513
ingestedAt: '2026-09-08T18:07:34.904Z'
---

## Overview

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.