https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:11:38.037490+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274783 EUVD-2026-274783 2026-10-06T17:11:38.089318+00:00 EUVD-2026-274783 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28507 fkie_cve-2026-28507 2026-10-06T17:11:38.089356+00:00

Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and template path traversal. This issue has been patched in version 1.6.4.

 https://cve.radiocsirt.org/vuln/ghsa-37j7-56xc-c468 GHSA-37j7-56xc-c468 — Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal 2026-10-06T17:11:38.089389+00:00

Affected: Packagist: idno/known

**Affected Versions:** Tested on current `dev` branch (build fingerprint `505[...]7bd86`) **CVSS v4 Score:** 8.6 ([CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)) **Privileges Required:** Web application admin account (for file write), any authenticated user (for RCE trigger)

---

## Summary

Two separate vulnerabilities in Idno can be chained to achieve RCE from a web application admin account. A web application admin can cause the server to fetch an attacker-controlled URL during WordPress import processing, writing a PHP file to the server's temp directory. The admin or a separate, lower-privileged authenticated user can then trigger inclusion of that file via an unsanitized template name parameter, executing arbitrary operating system commands as the web server user.

---

## Vulnerability 1: Arbitrary PHP File Write via WordPress Import (SSRF + File Write)

### Location

`Idno/Core/Migration.php` — `importImagesFromBodyHTML()`

### Required Privilege

Web application admin (any user with the `admin` flag set in the database, accessible via the Idno admin UI).

### Description

When a web application admin imports a WordPress eXtended RSS (WXR) XML file via `POST /admin/import/`, the application processes `<img>` tags in post body content and attempts to re-host images locally. The function`importImagesFromBodyHTML()` fetches each image URL usin…