Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal
Date: 2026-03
Affected: composer/idno/known
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-28507
CWE: CWE-78

**Affected Versions:** Tested on current `dev` branch (build fingerprint `505[...]7bd86`) **CVSS v4 Score:** 8.6 ([CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)) **Privileges Required:** Web application admin account (for file write), any authenticated user (for RCE trigger) --- ## Summary Two separate vulnerabilities in Idno can be chained to achieve RCE from a web application admin account. A web application admin can cause the server to fetch an attacker-controlled URL during WordPress import processing, writing a PHP file to the server's temp directory. The admin or a separate, lower-privileged authenticated user can then trigger inclusion of that file via an unsanitized template name parameter, executing arbitrary operating system commands as the web server user. --- ## Vulnerability 1: Arbitrary PHP File Write via WordPress Import (SSRF + File Write) ### Location `Idno/Core/Migration.php` — `importImagesFromBodyHTML()` ### Required Privilege Web application admin (any user with the `admin` flag set in the database, accessible via the Idno admin UI). ### Description When a web application admin imports a WordPress eXtended RSS (WXR) XML file via `POST /admin/import/`, the application processes `<img>` tags in post body content and attempts to re-host images locally. The function`importImagesFromBodyHTML()` fetches each image URL using


Mitigations:

Architectural layers (MAESTRO):