CVE-2026-18424

EUVD-2026-79503 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-09-15 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-fmfq-8qcq-wrx4

SSRF

2.1

CVSS 4.0 · Vendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Severity by source

Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ff5b8ace-8b95-4078-9743-eac1ca5451de) · only source for this CVE.

CVSS VectorVendor: ff5b8ace-8b95-4078-9743-eac1ca5451de

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:46 vuln.today

DescriptionCVE.org

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A low-privileged authenticated user permitted to import files could therefore supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during the unpinned download, causing the server to fetch internal-only resources such as loopback services, internal admin panels, or cloud metadata endpoints and to save the responses into the file manager. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Thanks Ahmad Wicaksono (sonix03) for reporting.

AnalysisAI

Server-side request forgery in Concrete CMS 9.0.0 through 9.5.2 allows an authenticated user who holds file-import privileges to make the server fetch internal-only resources by abusing a DNS pin that is validated once per host and then reused for every later URL on that host. Because the pinned validation and the unpinned download can resolve to different addresses, a rebinding host can redirect the request to loopback services, internal admin panels, or cloud metadata endpoints, with responses saved into the file manager. …