Pagekit EUVD-2026-25659

Exploitation requires valid Pagekit administrator credentials with high privilege level (indicated by CVSS PR:H). The vulnerable endpoint is only accessible through the admin panel (/index.php/admin/system/update/download), which is protected by administrative authentication. The url parameter must be user-supplied and processed by the server without hostname/destination validation. No special Pagekit configuration or feature flags are mentioned as prerequisites - the vulnerability exists in standard Pagekit installations where the system update module is enabled. Attackers cannot exploit this remotely without first obtaining or compromising high-privilege admin credentials; it is not exploitable against default, unauthenticated Pagekit instances.

CVSS score of 4.7 (Medium) reflects the narrow attack surface: exploitation requires high-privilege administrator (PR:H) access over an unauthenticated network channel (AV:N/AC:L). While the severity is moderate, the risk is substantially limited by the high privilege requirement, which significantly reduces real-world exploitability compared to the network vector might suggest. EPSS data is not provided, but the presence of publicly available exploit code and vendor non-response increases the practical risk. The E:P (Exploit/Proof of Concept) evidence environmental score modifier confirms POC availability. This is a privilege escalation / lateral movement tool for authenticated admins rather than an initial compromise vector. Organizations must weigh the threat model: if Pagekit admin panels are exposed to untrusted networks or if admin credentials are compromised, this becomes a valuable pivot point for SSRF-based attacks.

An attacker with compromised Pagekit admin credentials (e.g., from a weak password or data breach) logs into the admin panel, navigates to System > Update, and modifies the download URL parameter to point to an internal service (e.g., http://localhost:8080/admin or http://internal-api.local/sensitive-data). The server processes the request and returns the response to the attacker, revealing internal service behavior, API endpoints, or sensitive data. Alternatively, the attacker uses the SSRF to interact with cloud metadata services (e.g., AWS EC2 metadata endpoint) to retrieve IAM credentials or other cloud secrets.