CVE-2026-33486: Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-26 · updated 2026-06-17
Weakness: CWE-918

Description

Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to read any file on the server's local file system that the web server process has access to, including highly sensitive environment variables, database credentials, and internal configuration files. Versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 contain a patch.

Affected products

roadiz core-bundle-dev-app: before 2.3.42; from 2.4.0 before 2.5.44; from 2.6.0 before 2.6.28; from 2.7.0 before 2.7.9 — fixed in 2.3.42, 2.5.44, 2.6.28, 2.7.9

How to fix

Upgrade to a fixed version: roadiz core-bundle-dev-app 2.3.42, 2.5.44, 2.6.28, 2.7.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33486 or the next vulnerability affects your stack