CVE-2026-49262

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

CVSS v3 3.0 LOW

3.0^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/aimeos/pagible/commit/09a8205d513ec89ed22cdd7bdae0f4c181cee082
https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789
https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En el sistema de gestión de contenidos Aimeos Pagible anterior a la versión 0.10.4, la ruta de proxy administrativa (’cmsproxy’) es vulnerable a un ataque de falsificación de petición del lado del servidor (SSRF) a través de Rebinding de DNS. Existe una condición de carrera de Tiempo de Verificación a Tiempo de Uso (TOCTOU) entre la fase de validación de URL y la fase de petición HTTP real, lo que permite a los atacantes acceder a recursos de red internos y a puntos finales de metadatos en la nube. La versión 0.10.4 corrige el problema.

Information

Published : 2026-08-12 15:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-49262

Mitre link : CVE-2026-49262

CVE.ORG link : CVE-2026-49262

JSON object : View

Products Affected

No product.

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-49262", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49262", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T15:17:21.495595Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.0, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "aimeos", "product": "pagible", "versions": [{"status": "affected", "version": "< 0.10.4"}]}]}], "published": "2026-08-12T15:17:35.867", "references": [{"url": "https://github.com/aimeos/pagible/commit/09a8205d513ec89ed22cdd7bdae0f4c181cee082", "source": "security-advisories@github.com"}, {"url": "https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789", "source": "security-advisories@github.com"}, {"url": "https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue."}, {"lang": "es", "value": "En el sistema de gesti\u00f3n de contenidos Aimeos Pagible anterior a la versi\u00f3n 0.10.4, la ruta de proxy administrativa (\u2019cmsproxy\u2019) es vulnerable a un ataque de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de Rebinding de DNS. Existe una condici\u00f3n de carrera de Tiempo de Verificaci\u00f3n a Tiempo de Uso (TOCTOU) entre la fase de validaci\u00f3n de URL y la fase de petici\u00f3n HTTP real, lo que permite a los atacantes acceder a recursos de red internos y a puntos finales de metadatos en la nube. La versi\u00f3n 0.10.4 corrige el problema."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}