CVE-2026-3163

MediumPublic PoC

Published: 25 February 2026

Published

25 February 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0005 15.7th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3163 is a medium-severity SSRF (CWE-918) vulnerability in Remyandrade Website Link Extractor. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing web app (file_get_contents URL handler) directly enables remote exploitation of the application to force unintended outbound requests to internal resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has…

been disclosed to the public and may be used.

Deeper analysisAI

CVE-2026-3163 is a server-side request forgery (SSRF) vulnerability, associated with CWE-918, affecting SourceCodester Website Link Extractor version 1.0. The flaw exists in the file_get_contents function of the URL Handler component, where manipulation enables SSRF. Published on 2026-02-25, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation triggers the server to make unintended requests, potentially allowing access to internal resources, with limited impacts on confidentiality, integrity, and availability.

Advisories on VulDB (ctiid.347670, id.347670, submit.758932) and a Medium post document the issue and public exploit disclosure. The vendor site at sourcecodester.com is referenced, but specific patch or mitigation details are not outlined in the available descriptions.

The exploit has been disclosed publicly and may be used, heightening the risk of real-world attacks.