PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5518 Metalgenix CVE debrief

CVE-2017-5518 describes a server-side request forgery (SSRF) weakness in the GeniXCMS media-file upload feature affecting versions through 0.0.8. The issue can let a remote attacker submit a URL that causes the application to make unexpected server-side requests, including toward intranet addresses. NVD assigns CWE-918 and a HIGH severity score (CVSS 3.0: 7.4), reflecting the potential for impact beyond the application boundary.

Vendor
Metalgenix
Product
Genixcms
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-17
Original CVE updated
2026-05-13
Advisory published
2017-01-17
Advisory updated
2026-05-13

Who should care

Administrators, developers, and security teams running GeniXCMS through 0.0.8 should treat this as high priority, especially if the media-upload workflow accepts user-controlled URLs or can reach internal network resources.

Technical summary

The vulnerable feature is the media-file upload path, which accepts a URL and may fetch it server-side. NVD classifies the weakness as CWE-918 (SSRF) with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N. That combination indicates unauthenticated network reachability, user interaction, and the possibility of the vulnerable server being induced to interact with unintended internal or adjacent systems.

Defensive priority

High. SSRF in a web-facing upload path can expose internal services, metadata endpoints, or network-only resources even without direct authentication.

Recommended defensive actions

  • Identify any GeniXCMS deployment at version 0.0.8 or earlier and assume the media-upload URL path is exposed until verified otherwise.
  • Restrict or disable remote URL fetching in the media upload feature if it is not required.
  • Enforce strict allowlists for outbound destinations and block private, loopback, link-local, and other reserved address ranges.
  • Limit acceptable URL schemes and reject non-HTTP(S) inputs if the feature must remain enabled.
  • Apply the project fix or remediation referenced in the linked issue tracker before re-enabling URL-based media ingestion.
  • Monitor outbound requests from the application and review logs for requests targeting internal or unusual network locations.

Evidence notes

The CVE record and NVD detail both identify GeniXCMS through 0.0.8 as vulnerable and classify the weakness as CWE-918. The supplied references include a SecurityFocus BID entry and a GitHub issue tagged with exploit, issue tracking, and patch, which supports remediation context without adding unsupported details.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5518 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5518

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5518 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5518

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.