The vulnerability is an SSRF flaw present in the UEditor remote image fetch feature of DoraCMS versions 3.1 and earlier. The application takes a user‑supplied URL, fetches the image via an outbound HTTP or HTTPS request, and returns the response without checking the target address or applying restrictions. Due to this lack of validation, an attacker can cause the server to query arbitrary hosts, including internal network services, and can configure the request to exhaust resources or bypass firewall rules. The flaw is classified as CWE‑918 and could lead to information disclosure or denial of service.

Vendors: Doramart. Product: DoraCMS. Affected versions: 3.1 and all earlier releases.

This flaw carries a CVSS score of 6.9, indicating a medium severity impact, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been reported. An attacker can abuse the flaw by sending a malicious URL through the UEditor remote image fetch endpoint; the server then performs an outbound request to the specified address. Because the request is not filtered, the attacker can target internal IP ranges, scan for services, or cause resource exhaustion. The attack requires only that the target system accepts the request, making it feasible for a remote adversary with internet access to trigger the SSRF.