| शीर्षक | pagekit v1.0.18 Server-Side Request Forgery |
|---|
| विवरण | ## Overview
PageKit CMS v1.0.18 has an SSRF vulnerability in `UpdateController::downloadAction()`. The `$url` parameter is passed to `fopen()` without any filtering, so an authenticated admin can make the server request arbitrary internal URLs.
## Root Cause
File: `app/installer/src/Controller/UpdateController.php` Line 32-42
```php
public function downloadAction($url)
{
$file = tempnam(App::get('path.temp'), 'update_');
App::session()->set('system.update', $file);
if (!file_put_contents($file, @fopen($url, 'r'))) {
App::abort(500, 'Download failed or path not writable.');
}
return [];
}
```
## Fix
No patch available. Mitigations:
- Stop using PageKit (it's dead)
- Block `/admin/system/update/download` at WAF level
- Network-segment the web server away from sensitive internal services |
|---|
| स्रोत | ⚠️ https://github.com/d0ctorsec/CVE-Reports/tree/main/CVE-Pagekit%E2%80%94v1.0.18-SSRF |
|---|
| उपयोगकर्ता | dactar (UID 73087) |
|---|
| सबमिशन | 12/07/2026 07:17 PM (3 महीनों पहले) |
|---|
| संयम | 02/09/2026 09:35 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 238216 [Pagekit 1.0.18 UpdateController.php thedownloadAction/updateAction अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|