"Add module from URL" feature SSRF issue (CVE-2026-40500)

[teppokoivula]

Hey Ryan,

There is a publicly reported SSRF issue in the "Add module from URL" feature in admin, see GHSA-gmwr-9j4p-96vm or https://nvd.nist.gov/vuln/detail/CVE-2026-40500. Though the scope is limited, this is an issue in part because it is being reported by third-party audits / audit tools.

As far as I can tell this has not been resolved in any existing version, dev included, but let me know if I am wrong.

Could you take a closer look at this? Thank you!

Also, sorry if this has been reported before, I couldn't find any references here. And for some reason the issue template is also no longer working.

[ryancramerdesign]

@teppokoivula This was reported awhile ago. I looked at it closely and didn't find it to be a security issue. I got the impression the author had already committed to it as some kind of requirement for a school project or something, and didn't seem open to understanding it. I don't think the author understood ProcessWire's role as a developer tool or superuser context. To see what I mean, go to the URL you linked above and click the GitHub link there.

To explore the author's issue, it requires the developer intentionally override ProcessWire's default behavior to enable module installation by URL in the config.php file. Once manually enabled, superuser can install modules by URL, per their setting, whether for debug mode only or not.

My analysis was that the author's suggested changes didn't provide any additional security, prevented the superuser from seeing legit error messages, and interfered with the ability to use the feature in some of its intended use cases. If we decided we wanted to do something bad to our own site or server, it would be far simpler to just put bad code in a module and then install it (by URL or otherwise).

The ability to install modules by URL is powerful and comes with inherent responsibility, which is why we make it fairly difficult to enable in the first place. The same responsibility that comes with tools like TracyDebugger, PhpMyAdmin, or any developer tool. ProcessWire is in many respects also a developer tool and I don't want to neuter it for fake security or for a school project, etc.