Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Date: 2026-03
Affected: composer/roadiz/documents, composer/roadiz/documents, composer/roadiz/documents
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33486
CWE: CWE-918
CVSS: 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)

This vulnerability allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. | Field | Details | | :--- | :--- | | **Vulnerability Class** | Server-Side Request Forgery (SSRF) & Local File Inclusion (LFI) | | **Affected Component** | `RZ\Roadiz\Documents\DownloadedFile::fromUrl()` | | **Prerequisites** | Authenticated user with `ROLE_ACCESS_DOCUMENTS` | ## Technical Description The Roadiz backend features tools for importing external media, such as compiling cover art from Podcast RSS Feeds or OEmbed providers. This feature is handled by various `MediaFinders`, which ultimately pass the extracted media URLs to the `DownloadedFile::fromUrl(string $url)` parsing mechanism. Inside `fromUrl()`, the application uses PHP's native `fopen()` function to fetch the remote resource and copy it into the local temporary directory before injecting it into the Flysystem Documents storage. ## The Flaw The `$url` parameter is passed to `fopen` *without any schema validation or sanitization*. In PHP, when stream wrappers are enabled, functions like `fopen` do not restrict operations to HTTP streams. If a `file://` scheme is supplied, PHP seamlessly converts the operation into a local file system read. Because an attacker tightly controls the XML feed (e.g., from a Podcast integration), they can inject a `file://` U


Mitigations:

Architectural layers (MAESTRO):