CVE-2026-49262

Name of the Vulnerable Software and Affected Versions Aimeos Pagible versions prior to 0.10.4

Description The administrative proxy route /cmsproxy is susceptible to Server-Side Request Forgery (SSRF) through DNS Rebinding. This occurs due to a Time-of-Check to Time-of-Use (TOCTOU) race condition—a scenario where a system checks a condition (such as a security credential) and then uses the result of that check, but the condition changes between the check and the use. In this case, the AdminController::proxy controller validates the target URL using the isValidUrl() function to ensure the hostname does not resolve to private or reserved IP ranges. However, because a second DNS lookup is performed during the actual HTTP request, an attacker can use a malicious DNS server with a TTL of 0 to return a safe IP during validation and a private IP during the request, enabling access to internal network resources and cloud metadata endpoints.

Recommendations Update Aimeos Pagible to version 0.10.4. As a temporary workaround, restrict access to the /cmsproxy endpoint to minimize the risk of exploitation.