External risk intelligence

Zyplayer-Doc SSRF Vulnerability via WikiPageWebService Download

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-75332

Zyplayer-Doc is a document management and knowledge base system typically deployed as a web application. Such applications are commonly exposed to the internet to facilitate remote access for users, making the web-based interface and its associated services, such as the affected WikiPageWebService, reachable in standard deployment patterns.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in Zyplayer-Doc, a document management system, that could allow unauthorized access to internal resources by tricking the software into making requests on behalf of an attacker. The core issue is a Server-Side Request Forgery vulnerability within the WikiPageWebService.download() function, which, given its potential to access sensitive information, warrants careful consideration.

Software can be tricked into making malicious requests.
Critical vulnerability could expose internal network resources.
Confirm relevance and potential exposure for affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted request to the vulnerable WikiPageWebService.download() function in Zyplayer-Doc. This could allow the attacker to make the server send requests to arbitrary internal or external resources, potentially leading to sensitive information disclosure or unauthorized actions.

No authentication required.
Triggers through WikiPageWebService.download().
Server-side request forgery.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the Zyplayer-Doc WikiPageWebService.download() function could be exploited via Server-Side Request Forgery (SSRF). This vulnerability may allow an unauthenticated attacker to control requests made by the Zyplayer-Doc server.

Server-side application logic.
Unauthenticated network requests.
Unauthorized server access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SSRF vulnerability in Zyplayer-Doc affects its WikiPageWebService.download() function. Ownership likely falls to the platform or application team managing the Zyplayer-Doc instance. The first step is to identify all deployments of Zyplayer-Doc, confirm their internet-facing exposure, and assess business criticality to prioritize remediation efforts with the responsible owner.

Platform or application team owns the issue.
Verify internet exposure and business criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zyplayer-Doc?

Zyplayer-Doc is a document management and knowledge base system. It functions as a web application where teams store, organize, and retrieve information. Because it acts as a centralized repository for documentation, it is typically hosted on a server where users can access it through a web browser to collaborate on files.

What is the vulnerability in CVE-2026-75332?

This CVE involves a Server-Side Request Forgery (SSRF), categorized as CWE-918. In plain terms, this means the software can be manipulated into making network requests on behalf of an attacker. Instead of the software only connecting to intended services, it is tricked into fetching data from unauthorized internal or external locations.

How is the SSRF triggered in Zyplayer-Doc?

The vulnerability is triggered by sending a specially crafted request to the WikiPageWebService.download() function. Because this function performs actions without requiring any authentication, an attacker does not need a user account to initiate the malicious request. Requests that do not interact with this specific download function do not trigger this bug.

Is my instance of Zyplayer-Doc at risk?

Halo Surface Signal indicates that Zyplayer-Doc is often deployed as an internet-facing web application. Since the service is frequently reachable by remote users in standard setups, the risk is higher if your instance is accessible from the public internet. Systems kept entirely within a private, restricted network face different accessibility factors.

What should I do if I run this software?

Begin by identifying all active deployments of Zyplayer-Doc within your environment. Once you have a complete inventory, check which instances are reachable over the internet versus those limited to internal use. Coordinate with the team responsible for managing these servers to assess business impact and prioritize the necessary remediation steps.

References

github.com/fangtang7/CVE/blob/main/Zyplayer-Doc/Zyplayer-Doc.md

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.