Skip to content
Threat Feed
Subscribe
high advisory

RhaPHP: Server-side request forgery (CVE-2026-116256)

An SSRF vulnerability in the RhaPHP Mp Module Media Proxy allows remote attackers to perform unauthorized requests via the url argument in the image function.

CVE search metadata

CVE search record: CVE-2026-116256. Severity: high. CVSS: 7.3. KEV: no. Product: RhaPHP (<= 7ae639ccf8dcb627faace096d030bd4cb4cfb905). Brief: RhaPHP: Server-side request forgery (CVE-2026-116256). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rhaphp-ssrf/

Triage facts

Revision 1
Applicability
RhaPHP (<= 7ae639ccf8dcb627faace096d030bd4cb4cfb905)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 26, 11:41 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A5Likely

CVE-2026-116256 describes a server-side request forgery (SSRF) vulnerability in the RhaPHP application, specifically within the Mp Module Media Proxy component. The vulnerability resides in the 'image' function of the file 'application/mp/controller/Show.php'. A remote attacker can trigger this vulnerability by manipulating the 'url' argument, which lacks sufficient validation. Public exploit material exists for this issue. RhaPHP uses a rolling release model, and the vendor has not provided a patch.

Impact

An attacker can leverage this SSRF vulnerability to make arbitrary requests from the RhaPHP server, potentially interacting with internal services, metadata endpoints, or other network-accessible resources that are not exposed to the public internet.

Recommendation

  1. Inventory all instances of RhaPHP within the environment.
  2. Implement strict egress filtering on the host running RhaPHP to prevent the application from making requests to sensitive internal subnets or cloud provider metadata services (e.g., 169.254.169.254).
  3. Deploy WAF rules to inspect HTTP GET/POST requests targeting 'application/mp/controller/Show.php' and flag/block requests where the 'url' parameter contains suspicious schemes (e.g., file://, dict://) or internal IP addresses.

Immediate actions

Deploy the provided Sigma rule to web server access logs to identify SSRF attempts targeting RhaPHP.

Detection Engineering 48h

Threat Hunt

Search web server logs for high volumes of requests to /application/mp/controller/Show.php

T1190 medium medium confidence hunt now

Data: web server access logs

Mitigations

Implement egress filtering and WAF rules to sanitize or block requests containing local IP addresses or suspicious protocols in URL parameters.

immediate IT Operations

CVE-2026-116256

Detection coverage 1

Detect CVE-2026-116256 Exploitation - SSRF via RhaPHP Mp Module

high

Detects exploitation attempts against CVE-2026-116256 by identifying requests to the vulnerable Show.php controller with suspicious URL patterns.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →