CVE-2026-40500: ProcessWire: server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature

April 16, 2026

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel’s ‘Add Module From URL’ feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

References

gist.github.com/thepiyushkumarshukla/7514e5eed526fd9d20fcfc42ce8d0a82
github.com/advisories/GHSA-gmwr-9j4p-96vm
nvd.nist.gov/vuln/detail/CVE-2026-40500
processwire.com/
www.vulncheck.com/advisories/processwire-cms-ssrf-via-add-module-from-url

Code Behaviors & Features

Detect and mitigate CVE-2026-40500 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →