CVE-2026-49262
Received Received - Intake

SSRF via DNS Rebinding in Aimeos Pagible CMS

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-49262
EUVD
EUVD-2026-57218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aimeos pagible to 0.10.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-49262 is a Server-Side Request Forgery (SSRF) vulnerability in the Aimeos Pagible CMS before version 0.10.4. It occurs due to a Time-of-Check to Time-of-Use (TOCTOU) race condition in the admin proxy route. The system validates URLs by checking if they resolve to public IPs but performs a second DNS lookup during the actual HTTP request. Attackers exploit this by controlling a DNS server to return safe IPs during validation and internal/private IPs during requests, allowing access to internal networks or cloud metadata endpoints.

Detection Guidance

To detect this SSRF vulnerability via DNS rebinding in Aimeos Pagible CMS, monitor network traffic for unexpected internal or cloud metadata requests originating from the admin proxy route. Check for DNS queries resolving to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints like AWS IMDS (169.254.169.254).

Inspect server logs for failed or unusual HTTP requests to internal IPs or metadata services. Use tools like tcpdump or Wireshark to capture outbound traffic from the application server.

Impact Analysis

This vulnerability allows attackers with low privileges and user interaction to access internal network resources or cloud metadata endpoints (like AWS Instance Metadata) by exploiting DNS rebinding. If exploited, it could lead to unauthorized access to sensitive internal systems or data, though the impact is limited due to the low CVSS score of 3.0.

Mitigation Strategies

Upgrade Aimeos Pagible CMS to version 0.10.4 or later, which includes fixes for the SSRF vulnerability and TOCTOU race condition.

Restrict network access to the admin proxy route by configuring firewalls or network policies to block outbound requests to internal IPs and cloud metadata endpoints.

Monitor DNS resolution logs for suspicious changes in IP mappings, particularly for domains controlled by users or external entities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart