What is CVE-2026-48707?

CVE-2026-48707 is a low-severity vulnerability in Instantsoft Icms2, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.1/10. Published 2026-09-08.

How severe is CVE-2026-48707?

Low severity. CVSS v3 base score is 3.1 out of 10.

SSRF in Instantsoft Icms2

CVE-2026-48707

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Instantsoft Icms2 — versions < 2.18.2

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-48707?: CVE-2026-48707 is a low-severity vulnerability in Instantsoft Icms2, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.1/10. Published 2026-09-08.
How severe is CVE-2026-48707?: Low severity. CVSS v3 base score is 3.1 out of 10.