mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery

The SSRF vulnerability in mingSoft MCMS presents a significant risk. An attacker can leverage this flaw to make the application initiate requests to internal services that are not directly accessible from the outside world. This could involve accessing sensitive configuration files, interacting with internal APIs, or even attempting to scan the internal network for other vulnerable systems. The availability of a public exploit dramatically increases the likelihood of exploitation, and the potential for widespread attacks targeting MCMS deployments is high. The blast radius extends beyond simple data exposure; an attacker could potentially use the SSRF to pivot and gain access to other systems within the internal network, depending on the permissions and access granted to the MCMS application.

Organizations using mingSoft MCMS versions 5.0 through 5.5.0 are at risk, particularly those with internal services accessible through the Editor Endpoint. Shared hosting environments utilizing MCMS are also at increased risk due to the potential for cross-tenant exploitation.

• java / server:

grep -r 'net/mingsoft/cms/action/BaseAction.java' /path/to/mcms/source
grep -r 'catchImage' /path/to/mcms/logs

• generic web:

curl -I http://your-mcms-server/editor/baseAction.action?catchimage=http://internal-service

1. 2026-03-27Disclosure

   disclosure

1. Reserviert2026-03-27
2. Veröffentlicht2026-03-27
3. Geändert2026-03-30
4. EPSS aktualisiert2026-04-04

The primary mitigation for CVE-2026-4953 is to upgrade to a patched version of mingSoft MCMS. Unfortunately, the specific fixed version is not provided. Until a patch is available, implement temporary workarounds to reduce the attack surface. Restrict network access to the MCMS server, limiting outbound connections to only necessary services. Implement strict input validation on the catchimage parameter, rejecting any requests with suspicious or unexpected values. Consider deploying a Web Application Firewall (WAF) with rules to detect and block SSRF attempts targeting the Editor Endpoint. Monitor access logs for unusual outbound requests originating from the MCMS server.