CVE-2026-18424

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2

Description An issue exists during remote file import where the system reuses a host's validated DNS pin across different ports. When multiple remote URLs share the same host, the system retains only the first ValidatedRemoteUrl and applies it to subsequent URLs for that host. A low-privileged authenticated user with file import permissions can exploit this via DNS-rebinding. By providing a host that resolves to a public address during validation and a private or loopback address during the actual download, the server can be forced to fetch internal-only resources, such as loopback services, internal admin panels, or cloud metadata endpoints, and save the results into the file manager.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.