CVE-2026-37197 - Server-Side Request Forgery (SSRF) in NukeViet CMS v4.5.07

Overview

A Server-Side Request Forgery (SSRF) vulnerability exists in VINADES JSC NukeViet CMS v4.5.07 within the admin remote upload feature. The issue allows an authenticated administrator to trigger server-side HTTP requests to arbitrary URLs by supplying a crafted remote file URL during file upload.

This vulnerability may allow attackers to interact with internal network services, scan internal resources, or access restricted endpoints that are not directly reachable externally.

Vulnerability Details

• CVE ID: CVE-2026-37197
• Vulnerability Type: Server-Side Request Forgery (SSRF)
• Vendor: VINADES JSC
• Product: NukeViet CMS
• Affected Version: v4.5.07
• Attack Type: Remote
• Authentication Required: Yes (Administrator access required)
• Impact: Information Disclosure / Internal Network Enumeration

Affected Components

The vulnerability exists in the following components:

admin/upload/upload.php
vendor/vinades/nukeviet/Files/Upload.php

Affected functions include:

save_urlfile()
check_url()

These functions process a user-supplied remote file URL (fileurl) without sufficient validation or restrictions on outbound requests.

Technical Description

The remote upload functionality allows administrators to upload files using a URL source. When a crafted URL is supplied through the fileurl parameter, the application performs a server-side request to the provided destination.

Because insufficient validation is implemented, an attacker with administrative access can abuse this behavior to force the application server to initiate HTTP requests to arbitrary internal or external resources.

Additionally, redirect behavior is followed, increasing the risk of internal resource access and network reconnaissance.

Attack Vector

An authenticated administrator submits a crafted URL to the remote upload endpoint.

Example attack scenario:

1. Administrator accesses the remote upload functionality.
2. A malicious URL pointing to internal services is provided.
3. The server performs an outbound request.
4. Internal services may be probed or enumerated.

Example targets:

http://127.0.0.1
http://localhost
http://169.254.169.254
http://192.168.1.1
http://internal-service:8080

This may enable:

• Internal network scanning
• Access to internal-only services
• Cloud metadata exposure (environment dependent)
• Information disclosure

Proof of Concept (PoC)

Example crafted request:

POST /admin/index.php?language=en&nv=upload&op=upload HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Cookie: admin_session=SESSION

fileurl=http://127.0.0.1:8080

The server attempts to fetch the supplied URL, resulting in a server-side request to an internal resource.

Security Impact

Successful exploitation may allow an attacker to:

• Enumerate internal network services
• Scan localhost or internal IP ranges
• Access sensitive internal endpoints
• Retrieve information from internal services
• Potentially access cloud metadata services depending on deployment configuration

Root Cause

The issue occurs due to:

• Lack of proper URL validation
• Missing outbound request restrictions
• No allowlist/blocklist enforcement for internal IP ranges
• Redirects being followed automatically

Recommended Mitigation

VINADES JSC should implement the following mitigations:

1. Block requests to internal/private IP ranges:

127.0.0.0/8
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
169.254.169.254
localhost

2. Restrict allowed protocols to:

http
https

3. Disable or restrict redirects.

4. Implement hostname and DNS validation to prevent SSRF bypass techniques.

5. Use an allowlist approach for trusted remote domains where possible.

Timeline

• Vulnerability Discovered by: Pavan V
• Vendor Response: Fixed in upcoming release (if applicable)
• CVE Assigned: CVE-2026-37197

References

• Project Repository: https://github.com/nukeviet/nukeviet

Discoverer

Pavan V