A vulnerability in the Data Import module of Poesis Rhymix CMS up to version 2.1.33 allows an attacker to manipulate the filename argument in the procImporterAdminCheckXmlFile function and force the server to issue HTTP requests to arbitrary destinations. This server‑side request forgery (SSRF) can expose internal network resources, retrieve sensitive data, or serve as a foothold for further compromise. The flaw is a typical SSRF weakness (CWE‑918) that affects confidentiality and integrity of internal services and could enable lateral moves or data exfiltration.

The issue affects Poesis Rhymix CMS installations running any release up to and including 2.1.33. The vendor recommends upgrading to release 2.1.34, which contains the fix for the SSRF vulnerability in modules/importer/importer.admin.controller.php.

The CVSS score is 5.1, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of widespread exploitation is uncertain. The attack vector is remote, relying on the ability to submit a crafted filename to the vulnerable routine. Once executed, the SSRF can be leveraged by attackers who can reach the affected CMS instance from the internet.