Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch.
PUBLISHED5.2CWE-918
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Problem type
Affected products
roadiz
core-bundle-dev-app
>= 2.7.0, < 2.7.9 - AFFECTED
>= 2.6.0, < 2.6.28 - AFFECTED
>= 2.4.0, < 2.5.44 - AFFECTED
< 2.3.42 - AFFECTED
References
https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g
https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g
https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2
https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2
GitHub Security Advisories
GHSA-rc55-58f4-687g
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
https://github.com/advisories/GHSA-rc55-58f4-687gThis vulnerability allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files.
Vulnerability Class Server-Side Request Forgery (SSRF) & Local File Inclusion (LFI) Affected ComponentRZ\Roadiz\Documents\DownloadedFile::fromUrl()
Prerequisites
Authenticated user with ROLE_ACCESS_DOCUMENTS
Technical Description
The Roadiz backend features tools for importing external media, such as compiling cover art from Podcast RSS Feeds or OEmbed providers. This feature is handled by various MediaFinders, which ultimately pass the extracted media URLs to the DownloadedFile::fromUrl(string $url) parsing mechanism.
Inside fromUrl(), the application uses PHP's native fopen() function to fetch the remote resource and copy it into the local temporary directory before injecting it into the Flysystem Documents storage.
The Flaw
The $url parameter is passed to fopen without any schema validation or sanitization. In PHP, when stream wrappers are enabled, functions like fopen do not restrict operations to HTTP streams. If a file:// scheme is supplied, PHP seamlessly converts the operation into a local file system read. Because an attacker tightly controls the XML feed (e.g., from a Podcast integration), they can inject a file:// URI, forcing the CMS to "download" internal system files directly into the publicly accessible Media Library.
Proof of Concept (PoC)
To reliably reproduce this vulnerability without requiring a live external URL, the attacker simply mimics the behavior of the Podcast importer manipulating the internal system.
Step 1: Craft the Malicious Payload
The attacker creates a standard Podcast RSS XML feed (podcast.xml) and hosts it externally (or on an internal network reachable by the CMS). Inside this XML, the href attribute for the podcast thumbnail is weaponized to target a sensitive system file:
<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">
<channel>
<title>Roadiz LFI Exploit</title>
<!-- Payload triggers the local filesystem fetch via PHP streams -->
<itunes:image href="file:///app/.env" />
</channel>
</rss>
Step 2: Exploit the CMS
- Authenticate to the Roadiz Backoffice.
- Navigate to Documents (Media Manager).
- Select Add a document -> Import from URL (or trigger a Podcast sync).
- Supply the URL of the malicious
podcast.xmlfile.
Step 3: Extract the Data
- The
AbstractPodcastFinderprocesses the XML and feedsfile:///app/.envdirectly intoDownloadedFile::fromUrl(). - The Roadiz application silently reads its own
.envfile, creating a new "Document" arrayed with the contents of the file. - The file manifests in the Media Manager grid as a broken image icon.
- The attacker actively downloads the newly generated Document from the dashboard, successfully extracting the framework's internal API keys, database credentials, and
APP_SECRET.
Impact Analysis
Exploitation of this vulnerability results in a total loss of Confidentiality for the web application and underlying operating system.
- Application Compromise: An attacker can retrieve
.env,security.yaml, or database.sqlitefiles, leading to complete horizontal and vertical privilege escalation. - System Enumeration: The attacker can read
/etc/passwd, enumerating system users in preparation for lateral movement. - Cloud Environment Compromise: If deployed within AWS, Azure, or GCP, the SSRF vector can be pivoted to read internal cloud metadata endpoints (e.g.,
http://169.254.169.254/latest/meta-data/), allowing the attacker to steal Root IAM roles globally compromising the victim's infrastructure.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-33486Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-33486",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-03-26T18:47:26.997Z",
"dateReserved": "2026-03-20T16:16:48.971Z",
"datePublished": "2026-03-26T17:15:31.073Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-03-26T17:15:31.073Z"
},
"title": "Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents",
"descriptions": [
{
"lang": "en",
"value": "Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch."
}
],
"affected": [
{
"vendor": "roadiz",
"product": "core-bundle-dev-app",
"versions": [
{
"version": ">= 2.7.0, < 2.7.9",
"status": "affected"
},
{
"version": ">= 2.6.0, < 2.6.28",
"status": "affected"
},
{
"version": ">= 2.4.0, < 2.5.44",
"status": "affected"
},
{
"version": "< 2.3.42",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"cweId": "CWE-918",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g",
"name": "https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2",
"name": "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
}
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-03-26T18:47:26.997Z"
},
"title": "CISA ADP Vulnrichment",
"metrics": [
{}
]
}
]
}
}