CVE-2026-18424: Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A low-privileged authenticated user permitted to import files could therefore supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during the unpinned download, causing the server to fetch internal-only resources such as loopback services, internal admin panels, or cloud metadata endpoints and to save the responses into the file manager. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Thanks Ahmad Wicaksono (sonix03) for reporting.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a low-privileged user who has permission to import files. Exploitation also requires control of a DNS-rebinding host and the ability to provide multiple remote URLs using that same host on different ports.
What can an attacker access if exploitation succeeds?
The server may be induced to fetch private or loopback resources, including loopback services, internal administrative panels, or cloud metadata endpoints. Retrieved responses can be saved into the Concrete CMS file manager.
What makes exploitation difficult?
The attacker must cause the host to resolve to a public address during validation and then to a private or loopback address during the later, unpinned download. The issue depends on cross-port reuse of the host's initially validated DNS pin.