918

cwe.mitre.org • July 25, 2026

This code intends to receive a URL from a user, access the URL, and return the results to the user.

The given PHP code is vulnerable to Server-Side Request Forgery (SSRF) because it directly accepts a user-supplied URL from the $_GET['url'] parameter and fetches its content using file_get_contents(), without any validation or restrictions. This allows an attacker to request internal or restricted resources within the server's network, such as internal admin panels, cloud metadata endpoints, or local services running on localhost.

Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

Automated Static Analysis

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSRF Vulnerability in Cisco Unified CM Exposes Enterprises to Root Access Cisco disclosed a critical server-side request forgery (SSRF) vulnerability in its Unified Communications Manager (CVE-2026-20230) on June 3, 2026. This flaw allows attackers with network access to write arbitrary files to the operating system, potentially escalating privileges to root. A proof-of-concept exploit code was released shortly after the disclosure, increasing the urgency for affected organizations. The vulnerability impacts systems where the WebDialer service is enabled, which is often the case in enterprise environments. Cisco has assigned a Critical Security Impact Rating to this vulnerability, despite a CVSS score of 8.6. Administrators are advised to check the status of the WebDialer service and apply security updates promptly. Currently, there is no evidence of active exploitation, but the availability of PoC code raises concerns about potential attacks. Organizations are encouraged to disable the WebDialer service until patches are applied. 6 sources 72

Extracted Entities

918

The full story

Extracted Entities

Attack Types (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)