Read the docs
TI-2026-36457 Aliases CVE-2026-49262GHSA-mmj8-wcvw-6789

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

Priority LOW 14CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix Fixed pagible (aimeos): 0.10.4aimeos/pagible (Packagist): 0.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
aimeospagiblebefore 0.10.40.10.4Patch availableCNA
—aimeos/pagible (Packagist)before 0.10.40.10.4Patch availableGHSA-mmj8-wcvw-6789
  • pagible Vendoraimeos Affected before 0.10.4 Fixed in 0.10.4 Patch available CNA
  • aimeos/pagible (Packagist) Vendor— Affected before 0.10.4 Fixed in 0.10.4 Patch available GHSA-mmj8-wcvw-6789

Remediation

  • Fix · CNA pagible (aimeos) Fixed in 0.10.4
  • Fix · GHSA-mmj8-wcvw-6789 aimeos/pagible (Packagist) Fixed in 0.10.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49262
  2. 2026-10-03 Alias added: GHSA-mmj8-wcvw-6789

References

Other 3

  • TI-2021-22379 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection CVSS 4.0HIGH 8.8
  • TI-2024-25751 Aimeos HTML client may potentially reveal sensitive information in error log CVSS 3.1HIGH 8.8
  • TI-2024-24807 Aimeos Core remote code execution in web server context CVSS 3.1HIGH 7.2
  • TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
  • TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
  • TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences