So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The domestic website building system announced the repair of remote screenshot risks, what should the site without an upgrade do first.

📅 2026-11-01 👁️ 0

Announcement of the domestic website building system fixing the server-side request risk brought by the remote screenshot, what should the sites that have not been upgraded do first? Do three things in order: first, tighten the background permissions and the network range of the server, then make a verifiable backup, and then upgrade to the fixed version during off-peak hours. After the upgrade, clear the cache and check the pseudo-static rules. Waiting for automatic updates is not an action, and the trigger point of this kind of risk is on an editor function. As long as there is a background account that can be used, it can be repeatedly attempted.

Which function does the risk come from?

The announcement points to the editor's 'remote screenshot': Paste an external image address in the text, and the editor will fetch the image from the server and store it in the attachment directory of the site. This feature is for the convenience of content transfer, the problem lies in the action of 'retrieving an address provided by the user from the server'.

When the server initiates a request, it is located in an internal network, and internal network addresses are usually not open to the public network. If the target address is not restricted, you can write the image address as an internal network address or a local service address, and then use the server's hand to access ports and interfaces that should only be accessible internally. This type of usage is called Server-Side Request Forgery in vulnerability classification. It does not directly modify data, but is often used to probe internal networks and read the content returned by internal services.

There are two additional risks associated with the same function: When there are no size and timeout limits set, fetching a large image will occupy the connection for a long time, constituting a denial-of-service consumption; when source verification is not performed, the returned content is written to the attachment directory, and it will depend on the strictness of the file type limit afterwards.

What fixes were announced?

The handling of the V3.2.25 version is to patch these layers at once: add connection timeout to remote screenshot, limit the size of the content retrieved, add domain rebinding protection, and intercept addresses pointing to internal network segments; at the same time, a trusted proxy configuration is added to allow the site to correctly judge the real source when located after the proxy.

The item that is easily overlooked is the trusted proxy option. The common form of site deployment is that there is an additional reverse proxy or firewall in front, and the source address seen by the server is the proxy address rather than the visitor's address. Without configuration, access logs and frequency limits will record all requests to the same source, and the protective judgment will fail. The announcement puts this item together with the internal network address interception, which is exactly for this type of deployment.

The official also gives suggestions for actions before and after the upgrade: back up website files, databases, and custom templates before the upgrade, and clear the system cache and check the pseudo-static after the upgrade.

Temporary handling before the upgrade.

When it is not possible to upgrade immediately, the goal of the measure is to block the path of 'borrowing the server to obtain the internal network address' and list it from strong to weak in terms of effect.

The first step is to collect permissions. The remote screenshot entry is only available in the background, consolidate the background accounts to the necessary personnel, enable two-factor authentication, clean up long-term unused accounts, and the risk surface will significantly shrink.The second step is to limit outgoing network. At the host or network layer, prohibit the site process from accessing the internal network segment and the listening port of the local machine, only allowing external addresses that are indeed needed; this step directly offsets the issue of unblocked internal network addresses.The third step is to tighten the executable entry. The static and execution permissions of the site directory should be checked, the attachment directory should not be able to execute scripts, to prevent the retrieved files from being further utilized.The fourth step is to strengthen monitoring, focusing on the background login source, abnormally large outgoing requests, and write records in the attachment directory.

These are all transitional measures that cannot replace the upgrade. Once the transitional configuration takes effect, it must also be confirmed that it does not block normal functions, such as the need to refer to external image services.

What needs to be checked after the upgrade is complete.

According to the official recommendation, after the upgrade, first clear the system cache, then check the static rules, and avoid using old and new rules together to cause some addresses to be abnormal. The check should cover three types of addresses: list and detail pages, category and tag pages, and addresses with sorting or pagination parameters. The last type is most likely to fail after the rule change.

The confirmation of the recovery position and deployment layer is next. The backup must be completed before the upgrade, and it must be verified that it can be restored - in case of upgrade failure, it can roll back to the state before the upgrade, which is more convenient than rebuilding later; for sites deployed using Baota panel or Docker, it is also necessary to confirm that the configuration files in the container or site directory are not overwritten by the upgrade script, especially for the custom template and network restriction settings.

AnQiCMS in these two layers can be directly compared: The backup and recovery of data and static files are managed centrally by the background, the pseudo-static rules can be customized and consistent with the address generation logic, the deployment goes through Docker image or panel one-click method, and the upgrade process can follow the same verification process.

Finally, add one configuration verification: If the site is behind a proxy, confirm that the configuration for source judgment has been updated according to the new trusted proxy rules; otherwise, the access log and frequency limit will still record the wrong source, which is equivalent to fixing one problem and leaving another.

Common questions

Not using the remote capture function, should we upgrade or not?Whether. This entry can be tried as long as it exists, whether it is used does not affect the risk side; the upgrade will also bring other repair items.

Will limiting the outgoing network affect normal collection?Yes, it is necessary to make a whitelist according to the actual used image source and interface, and verify it in a small flow environment first before enabling it in full volume.

What should be checked first if an exception occurs in the front-end address after the upgrade?First clear the cache, then check the pseudo-static rules and the addresses with parameters, the two types of problems together cover most abnormal situations.

Related articles

After the site is hacked, should the cleaning costs and loss of business be calculated together?

The cost of cleaning after being hacked is quoted per occurrence, the loss of business is accumulated over time, and the two are different in terms of scope but must be calculated together: reporting only the cleaning fee will underestimate the cost of the event, as it does not include the recovery of search visibility, order loss, and subsequent reinforcement hours. The order of handling is to isolate first, clean next, and then check the entry, and after recovery, use backups and recycle bins to verify whether it has returned to a clean state.

2026-11-01

Which type of spam submissions do the honeytrap field and captcha each block, can only one be left

The honey pot field blocks script submissions that do not parse styles, there is no visible challenge for real visitors; the scoring captcha is scored according to the possibility of robots, at the cost of mistakenly harming some real users. The two methods do not face each other, and whether only one can stand depends on the composition of garbage: when the amount of scripts is mainly used, the honey pot is enough, but when there are submissions with changed addresses and natural content, only the honey pot is not enough.

2026-11-01

The training crawler was blocked in robots, why can't the content still be retrieved

There are tests from more than 2,300 sites showing that only 3.6% of the sites block training crawlers in robots, but when accessing the homepage directly by real identity, 18.8% cannot access usable content. There is a gap between declarations and actual usability: writing rules does not mean they take effect, and there are also cases where the side that grants access cannot access the text. Self-inspection should be in order of four types of signals, not just whether that line of rules is in the text.

2026-11-01

The adoption rate statistics of the two llms.txt files are very different, which decision口径 should be adopted?

Two studies that were checked on the same day are very different: The adoption rate is 8.3% when statistics are taken from the top ten thousand domain names, and it reaches 49.2% when statistics are taken from more than two thousand sites. The difference does not come from who made a mistake in the calculation, but from the denominator range and the method of judgment. When making decisions, do not take the average of the two numbers, but first see which category your site falls into among the samples, and then confirm whether the口径 can be used by checking the three-step verification method.

2026-11-01

Most of the plugin vulnerability weekly reports can be triggered without logging in, how to filter out the ones in use.

The plugin vulnerability weekly report adds hundreds of new items in a week, among which a considerable number can be triggered without login. To filter out the components in use, the sequence is to first establish a component ledger, then filter by whether in use and whether login-free, which can reach two levels of filtering, and finally sort by severity. This article provides the screening method and disposal steps from the weekly report to the personal list.

2026-11-01

The competitors have also added new functions related to AI. Should we change the system when selecting?

Competitor update logs show new AI features, which do not constitute a reason to replace the content management system. The selection should be based on whether this capability can be integrated into the existing editing and publishing process, rather than the names of the features listed. This article provides a four-step verification method and uses already implemented capabilities such as AI automatic tagging and automatic title image matching as a reference.

2026-11-01

How much is the long-term difference between self-built content and hosted website construction, and how is it calculated on an annual basis?

The annual cost of self-built content management and hosting construction should be calculated over the same time span: hosting is a continuous subscription, and self-built is server plus operation and maintenance personnel. This article gives a reusable annual algorithm and potential items that are easy to overlook for three types of websites: construction, marketing websites, and cross-border or multilingual websites.

2026-11-01

It may also be possible to insert code during the background upgrade process, and these risk sites need to check which section first.

The upgrade process itself may be an attack window: The vulnerability disclosed in WordPress 7.1.4 occurs between download and write. The site should first clarify the entrance and exit of the upgrade window, the sequence of actions being backup and network shutdown, executing the upgrade, and then verifying file integrity and permissions after the upgrade.

2026-11-01