Raytha CMS is vulnerable to Server‑Side Request Forgery (SSRF) through the "Themes – Import from URL" feature, allowing an attacker with high privileges to supply an arbitrary URL that the server will request. This weakness, identified as CWE‑918, can enable access to internal network resources, exfiltration of sensitive data, or further lateral movement, compromising data confidentiality, integrity, and potentially availability of the target system.

The affected product is Raytha CMS under the vendor Raytha:Raytha. The vulnerability exists in all releases prior to version 1.4.6, as the issue was fixed in that release.

The CVSS score is 5.1, indicating a moderate severity, while the EPSS score is below 1%, signifying a low likelihood of exploitation. It is not listed in CISA's KEV catalog. Exploitation requires the attacker to have high‑privilege access to the CMS in order to use the import-from‑URL feature. Once accessed, the SSRF can reach any endpoint that the server can contact, including internal services and the Internet.