CVE-2026-116256 geesondog CVE debrief

Who should care

Defenders and administrators of geesondog RhaPHP installations, especially those with remotely accessible Mp Module Media Proxy Show.php image functionality, should verify exposure and assess the risk of server-side request forgery attacks.

Why it matters

CVE-2026-116256 is a server-side request forgery vulnerability in geesondog RhaPHP Mp Module Media Proxy Show.php image functionality. Defenders should verify exposure, especially in remotely accessible environments, and assess the risk of server-side request forgery attacks. The exploit has been made public, increasing the urgency for verification and potential remediation.

• Verify exposure of RhaPHP Mp Module Media Proxy Show.php image functionality to remote attacks.
• Assess feasibility of server-side request forgery attacks.
• Monitor for potential exploitation attempts.
• Review and update affected versions if available.

Technical summary

The vulnerability is in the image function of Show.php in the Mp Module Media Proxy of geesondog RhaPHP, allowing for server-side request forgery through manipulation of the url argument. The attack can be launched remotely, and the exploit has been made public. Affected product deployments should be verified for exposure, especially in remotely accessible environments, and defenders should assess the feasibility of server-side request forgery attacks. The product operates on a rolling release basis, ensuring continuous delivery, and there are no version details for either affected or updated releases.

Defensive priority

Defenders should prioritize verifying exposure of RhaPHP Mp Module Media Proxy Show.php image functionality, especially in environments where remote access is possible, and assess the feasibility of server-side request forgery attacks.

Recommended defensive actions

• Verify RhaPHP Mp Module Media Proxy Show.php image functionality exposure, especially in remotely accessible environments.
• Assess the feasibility of server-side request forgery attacks.
• Monitor for potential exploitation attempts.
• Review and update affected versions if available.
• Perform vulnerability scanning to identify exposed systems.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. The affected component is Mp Module Media Proxy, specifically the image function in Show.php. The vulnerability allows for server-side request forgery via manipulation of the url argument.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.