CVE-2026-49262 in Pagible
Summary
by MITRE • 08/12/2026
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The Aimeos Pagible content management system version 0.10.3 and earlier contains a critical server-side request forgery vulnerability in its administrative proxy route known as cmsproxy. This vulnerability stems from a fundamental flaw in how the system handles external URL validation and subsequent HTTP requests, creating an exploitable time-of-check to time-of-use race condition that enables attackers to bypass intended security restrictions. The flaw specifically affects the administrative proxy functionality that is designed to fetch content from external sources while maintaining internal network boundaries.
The technical implementation of this vulnerability relies on DNS rebinding techniques combined with a timing window between URL validation and actual request execution. During the initial validation phase, the system performs checks against allowed domains or IP ranges, but due to the TOCTOU condition, an attacker can manipulate DNS resolution between validation and execution phases. This allows malicious actors to initially appear as legitimate requests while later accessing internal network resources that should otherwise be restricted. The vulnerability is particularly dangerous because it operates at the proxy layer where administrative access typically provides broad network visibility and potential privilege escalation opportunities.
The operational impact of this vulnerability extends beyond simple information disclosure, as attackers can leverage it to access internal cloud metadata endpoints such as AWS instance metadata services or similar internal APIs that contain sensitive credentials and configuration data. This creates a significant risk for organizations deploying Aimeos Pagible in cloud environments where such metadata endpoints often contain access keys, instance identifiers, and network configuration details. The attack vector is particularly insidious because it can be executed without requiring authentication to the administrative interface itself, making it accessible even when proper access controls are in place.
Security researchers have classified this vulnerability according to CWE-918, which specifically addresses server-side request forgery flaws, and it aligns with ATT&CK technique T1071.004 for application layer protocol manipulation. The timing attack aspect of the vulnerability also relates to CWE-367, which covers time-of-check to time-of-use flaws in system security policies. Organizations using affected versions should prioritize immediate patching to version 0.10.4 or later, as this update implements proper validation mechanisms that prevent DNS rebinding attacks and eliminate the race condition between validation and execution phases. The fix typically involves implementing strict URL validation with no opportunity for DNS manipulation between checks and actual requests, ensuring that all proxy operations are performed within a controlled security boundary.