{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/geesondog/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:geesondog:rhaphp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-116256"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RhaPHP (\u003c= 7ae639ccf8dcb627faace096d030bd4cb4cfb905)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["geesondog"],"content_html":"\u003cp\u003eCVE-2026-116256 describes a server-side request forgery (SSRF) vulnerability in the RhaPHP application, specifically within the Mp Module Media Proxy component. The vulnerability resides in the 'image' function of the file 'application/mp/controller/Show.php'. A remote attacker can trigger this vulnerability by manipulating the 'url' argument, which lacks sufficient validation. Public exploit material exists for this issue. RhaPHP uses a rolling release model, and the vendor has not provided a patch.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can leverage this SSRF vulnerability to make arbitrary requests from the RhaPHP server, potentially interacting with internal services, metadata endpoints, or other network-accessible resources that are not exposed to the public internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of RhaPHP within the environment.\u003c/li\u003e\n\u003cli\u003eImplement strict egress filtering on the host running RhaPHP to prevent the application from making requests to sensitive internal subnets or cloud provider metadata services (e.g., 169.254.169.254).\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to inspect HTTP GET/POST requests targeting 'application/mp/controller/Show.php' and flag/block requests where the 'url' parameter contains suspicious schemes (e.g., file://, dict://) or internal IP addresses.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-26T11:41:40Z","date_published":"2026-10-26T11:41:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rhaphp-ssrf/","summary":"An SSRF vulnerability in the RhaPHP Mp Module Media Proxy allows remote attackers to perform unauthorized requests via the url argument in the image function.","title":"RhaPHP: Server-side request forgery (CVE-2026-116256)","url":"https://feed.craftedsignal.io/briefs/2026-10-rhaphp-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Geesondog","version":"https://jsonfeed.org/version/1.1"}