CVE-2023-1046

MuYuCMS getFile.html server-side request forgery

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.16.3Medium EPSS percentile48th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2023-02-26Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

n/a MuYuCMSAffected: 2.2Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run muyucms 2.2 and whether administrators can access the update feature.
No fixed version has been published; ask the vendor for a supported patched release or migration path.
Until then, restrict administrator access to trusted staff and block the affected update page if it is not needed.
Limit the server's outbound connections so it cannot reach internal systems or cloud-management addresses unnecessarily.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221805 was assigned to this vulnerability.

In plain language

Written by AI from the record

muyucms 2.2 lets a logged-in attacker make your server contact unintended places, so businesses using it should reduce exposure and plan a replacement or vendor fix.

Authenticated SSRF in MuYuCMS 2.2 via the `url` parameter of `/admin.php/update/getFile.html`, enabling server-side requests to attacker-chosen destinations.

If you're affected

Internal system access
Sensitive data exposure
Service disruption
Administrator account misuse

What is it

This flaw can let someone with access to the administration area tell the website server to fetch a location they choose. It is like allowing a visitor to use your office mailroom to send requests into rooms they should not be able to reach.

Who is affected

This matters to you if you run muyucms 2.2, especially if its administration area is available to multiple staff or outside contractors. It requires an attacker to already have a valid login to the administration area.

How urgent is it

A public proof-of-concept is available, meaning attackers have a published starting point for misuse. There is no evidence that attackers are actively exploiting it, and it is not on CISA's known-exploited list, but the lack of a published fix makes this an amber issue to contain and track.

What to do — in detail

Confirm whether the deployment is muyucms 2.2 and review access to /admin.php/update/getFile.html, particularly the update function that accepts a url value. No fixed version or supported upgrade path is currently available in the findings, so do not assume an upgrade resolves it; obtain vendor guidance or prepare to migrate if a fix is not provided.

If patching is delayed, disable or restrict the affected update endpoint, allow administrator access only from trusted networks, and restrict outbound server traffic to only required destinations. Review web and application logs for requests to that endpoint with unusual URL values, and investigate unexpected outbound connections from the server. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVSS 3.1 score: 6.3 (Medium), with network attack vector, low complexity, low privileges required, no user interaction, and low confidentiality, integrity, and availability impact. The weakness is CWE-918 server-side request forgery in the url argument of /admin.php/update/getFile.html. A public GitHub PoC is known, but KEV does not list the CVE and the findings provide no confirmed in-the-wild exploitation. EPSS is 0.6% at the 47th percentile with a flat trend; this is a prediction, not exploitation evidence.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS48th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 48th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 1104 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Record updated
2023-02-26Publishedweakness classified, att&ck mapped

Affected products

muyucms
- muyucmsOn-premWeb & CMS Plugins / cms-core

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Scored 6.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service