Medium, CVSS 6.8PackagistPublished
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
CVE-2026-33486 · GHSA-rc55-58f4-687g
- Affected
- Packagist roadiz/documents >= 2.7.0, < 2.7.9; >= 2.6.0, < 2.6.28; >= 2.4.0, < 2.5.44; < 2.3.42
- Fixed in
- 2.3.422.5.442.6.282.7.9· Vendor fix available
- Issue
- This vulnerability allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. | Field | Details | | :--- | :--- | | Vulnerability Class | Server-Side Request Forgery (SSRF) & Local File Inclusion (LFI) | | Affected Component | RZ\Roadiz\Documents\DownloadedFile::fromUrl() | | Prerequisites | Authenticated user with ROLEACCESSDOCUMENTS | Technical Description The Roadiz backend features tools for importing external media, such as compiling cover art from Podcast RSS Feeds or OEmbed providers. This feature is handled by various MediaFinders, which ultimately pass the extracted media URLs to the DownloadedFile::fromUrl(string $url) parsing mechanism. Inside fromUrl(), the application uses PHP's native fopen() function to fetch the remote resource and copy it into the local temporary directory before injecting it…
Recommended action: Upgrade to 2.7.9, 2.6.28, 2.5.44 or 2.3.42 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.