Server-side Request Forgery (SSRF) Affecting nukeviet/nukeviet package, versions <4.5.09
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-NUKEVIETNUKEVIET-17970638
- published14 Jul 2026
- disclosed13 Jul 2026
- creditg03m0n
Introduced: 13 Jul 2026
CVE-2026-55372 (opens in a new tab)How to fix?
Upgrade nukeviet/nukeviet to version 4.5.09 or higher.
Overview
nukeviet/nukeviet is a the first opensource CMS in Vietnam.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the server_info_update() function in includes/ini.php and the forwarded-host handling in vendor/vinades/nukeviet/Core/Server.php. An attacker can make the server issue a request to an attacker-chosen host by sending a pre-authentication POST request with __serverInfoUpdate=1 and spoofed X-Forwarded-Host and X-Forwarded-Proto headers. server_info_update() builds a cURL URL from the untrusted forwarded host and scheme, so the request is sent by the application itself before authentication is checked. The result is blind internal host and port probing and poisoning of the cached server-header data used by the site.