CVE-2026-40500
1 advisory.
Packagist/processwire/processwire CVE-2026-40500: medium 6.8
ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.0.255 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-gmwr-9j4p-96vm
- https://nvd.nist.gov/vuln/detail/CVE-2026-40500
- https://gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82
- https://github.com/processwire/processwire
- https://processwire.com
- https://www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url
CVE-2026-40500 · published · modified · JSON