CVE-2026-49262 — Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

Description (CNA)

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

Affected (CNA)

Vendor / product	Versions
aimeos / pagible	affected < 0.10.4

CWE

CWE-367, CWE-918

References

https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789
https://github.com/aimeos/pagible/commit/09a8205d513ec89ed22cdd7bdae0f4c181cee082

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789