mingSoft MCMS 编辑器端点 BaseAction.java catchImage 服务器端请求伪造漏洞

The SSRF vulnerability in mingSoft MCMS allows an attacker to craft malicious requests through the catchimage parameter. This can be leveraged to access internal resources that are not directly accessible from the outside world, such as internal APIs, databases, or other sensitive services. An attacker could potentially read sensitive data, modify configurations, or even gain a foothold for further attacks. The public availability of an exploit significantly increases the risk of exploitation, as it lowers the barrier to entry for malicious actors. This vulnerability could lead to data breaches, system compromise, and disruption of services.

Organizations using mingSoft MCMS versions 5.0 through 5.5.0 are at risk, particularly those with internal services accessible through the Editor Endpoint. Shared hosting environments utilizing MCMS are also at increased risk due to the potential for cross-tenant exploitation.

• java / server:

grep -r 'net/mingsoft/cms/action/BaseAction.java' /path/to/mcms/source
grep -r 'catchImage' /path/to/mcms/logs

• generic web:

curl -I http://your-mcms-server/editor/baseAction.action?catchimage=http://internal-service

1. 2026-03-27Disclosure

   disclosure

1. 已保留2026-03-27
2. 发布日期2026-03-27
3. 修改日期2026-03-30
4. EPSS 更新日期2026-04-04

The primary mitigation for CVE-2026-4953 is to upgrade to a patched version of mingSoft MCMS. Unfortunately, a fixed version is not specified in the provided data. As a temporary workaround, implement strict input validation on the catchimage parameter to prevent malicious URLs. Consider using a Web Application Firewall (WAF) with SSRF protection rules to block suspicious requests. Monitor access logs for unusual outbound requests originating from the Editor Endpoint.