CuteNews v.2.1.2 contains a Server‑Side Request Forgery vulnerability in its core/modules/media.php upload_from_inet function used by the Media Manager’s "Upload by URL" feature. The flaw permits an unauthenticated user to trigger the server to make arbitrary HTTP requests to any host, potentially exposing sensitive data or enabling further exploitation. Based on the description, it is inferred that an attacker could use this mechanism to read internal network resources, exfiltrate data, or pivot to privileged services. The vulnerability is classified as CWE‑918.

The affected product is CuteNews v.2.1.2, an open‑source content management system. The source‑code repository indicates no explicit vendor, implying that installations of this exact version with the default Media Manager module are susceptible.

The CVSS score of 9.1 signals critical severity, while the EPSS score of less than 1% indicates that active exploitation is presently rare. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, involving an unauthenticated request to the upload endpoint that causes the server to reach arbitrary internal or external URLs. The high severity and potential for internal data exposure or pivoting make this a priority for remediation.