SSRF Vulnerability in tarzan-cms Theme Download Function

A Server-Side Request Forgery (SSRF) vulnerability has been identified in tarzan-cms version 1.0.0. The flaw resides within the openConnection function of the ThemeService.java file, specifically within the Theme Download component. An unauthenticated remote attacker can exploit this by manipulating the httpUrl argument, causing the server to perform arbitrary outbound HTTP requests. This vulnerability, tracked as CVE-2026-90710, allows attackers to interact with internal network resources, potentially leading to unauthorized data access or service disruption within the hosting infrastructure. The vulnerability has been publicly disclosed, and as of the report date, the maintainers have not issued a patch or response. Defenders should treat this as a high-risk entry point for reconnaissance and potential lateral movement.

Impact

Successful exploitation allows a remote attacker to force the tarzan-cms application server to make requests to unintended destinations. This can be leveraged to scan internal networks, access sensitive internal APIs or metadata services (like AWS/Azure IMDS), and potentially bypass firewall restrictions. There is currently no vendor patch available, leaving all deployments of version 1.0.0 exposed to active exploitation.

Recommendation

• Monitor web server logs for requests to the Theme Download endpoint containing suspicious or internal network IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or localhost) in the httpUrl parameter.
• Restrict network access to the application server to prevent it from initiating outbound requests to internal resources.
• Implement egress filtering on the application server to permit only necessary outbound traffic to trusted domains or IP ranges.
• Disable the Theme Download functionality if it is not business-critical until a vendor patch is released.