A server‑side request forgery flaw exists in EyouCMS versions up to 1.8.3 within the remote_file_to_local function of application/function.php. By sending a crafted request, an attacker can instruct the application to fetch arbitrary URLs, enabling access to internal network resources, potential data exposure, or further exploitation if the fetched content is processed. The weakness corresponds to CWE‑918 and carries a CVSS score of 6.9, indicating moderate severity.

Vulnerable systems run EyouCMS up to version 1.8.3. The flaw is present in the remote_file_to_local function of application/function.php and applies to any installation that has not upgraded beyond the identified version.

The vulnerability is exploitable remotely without authentication, using a standard HTTP request to the exposed endpoint. Although no EPSS score is available and the issue has not been listed in the CISA KEV catalog, the moderate CVSS score suggests that exploitation is feasible and could provide attackers with internal network reach or data disclosure. Adherence to the vendor’s contact records shows no patch has yet been supplied, heightening the likelihood of ongoing risk.