CVE-2026-18424

Executive Summary

CVE-2026-18424 is a Server-Side Request Forgery (SSRF) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2, arising from cross-port reuse of a host's validated DNS pin during remote file import. When multiple remote URLs share the same host, only the first DNS validation result is retained, so later imports for that host may be fetched against a stale pin that no longer reflects the actual resolved address. A low-privileged authenticated user with file import permissions can supply a DNS-rebinding host that resolves to a public address during validation and to a private or loopback address during the unpinned download, causing the server to fetch internal-only resources and save the responses into the file manager. The Concrete CMS security team assigned a CVSS v4.0 score of 2.1, reflecting high attack complexity, high privileges required, and limited confidentiality impact.

Technical Analysis

The vulnerability class is CWE-918 (Server-Side Request Forgery). The affected component is the remote file import feature of Concrete CMS, exercised through its ValidatedRemoteUrl handling. According to the NVD description, the defect is a validation-caching flaw: when multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. The consequence is a cross-port reuse of a host's validated DNS pin — the server validates the host once, pins the resolved address, and then reuses that pin for subsequent requests to the same host over a different port, even though the second request resolves independently.

This creates a DNS rebinding window. An attacker-controlled hostname is configured so that its initial resolution returns a public (attacker-controlled or benign) address, passing whatever allow-list or public-address check the import validation performs. Because the validated result is cached and reused, the attacker can subsequently cause the same hostname to resolve to a private or loopback address (for example, 127.0.0.1 or an RFC1918 range). The unpinned download then connects to the internal target rather than the public address that was validated.

The attack surface is the authenticated file-manager import workflow. The attacker does not need administrative access: the description states that a low-privileged authenticated user permitted to import files can trigger the flaw. Technical details about the exact validation function internals, the caching data structure, and the precise request parameters are limited to what the advisory discloses (ValidatedRemoteUrl and its retention/reuse behavior). No public proof-of-concept or exploit code is available at the time of writing, so lower-level implementation specifics cannot be confirmed and are not asserted here.

Exploitation Scenarios

The following chain is inferred from the vulnerability class described in the NVD data; no public PoC exists.

1. Reconnaissance / target identification. The attacker obtains an authenticated account on the target Concrete CMS instance with permissions to import remote files. The attacker then identifies the remote import feature and prepares an attacker-controlled DNS domain (or subdomain) whose authoritative server can return different A/AAAA records over time (low TTL, rebinding-capable).

2. Triggering the flaw. The attacker submits an import request whose URLs share the same host but differ in port. The first URL's hostname resolves to a public address during validation and is recorded as the ValidatedRemoteUrl. Because validation results are cached per host, later URLs with that host reuse the retained pin rather than re-resolving.

3. Payload / execution method. The attacker changes the DNS response for the shared host so that subsequent resolution points to a private or loopback address. The unpinned download then connects to the internal target. The attacker does not deliver code; the "payload" is the attacker-controlled hostname plus the request that causes the server to fetch an internal resource.

4. Post-exploitation impact. The responses from the internal fetches — loopback services, internal admin panels, or cloud metadata endpoints — are saved into the file manager, where the attacker can read them. This yields limited information disclosure (reflected in VC:L/SC:L in the CVSS vector), such as cloud instance metadata credentials or internal service banners. Integrity and availability impacts are scored as none (VI:N/VA:N/SI:N/SA:N).

Impact Assessment

The CVSS v4.0 score of 2.1 reflects: network attack vector (AV:N), high attack complexity (AC:H, due to DNS rebinding timing requirements), attack requirements present (AT:P, the shared-host multi-URL condition), high privileges required (PR:H, authenticated user with import permission), and no user interaction (UI:N). The confidentiality impacts are low for both the vulnerable system (VC:L) and subsequent systems (SC:L); integrity and availability impacts are none. Business impact centers on exposure of internal-only services and cloud metadata that would normally be unreachable from the internet, saved into the file manager where the authenticated attacker can retrieve them. Blast radius is limited by the required account privilege and the rebinding complexity, but any instance running Concrete CMS 9.0.0–9.5.2 with remote import enabled and reachable by authenticated low-privileged users is in scope.

Detection Guidance

Sigma Rule

title: Concrete CMS Remote File Import SSRF via DNS Rebinding
id: 6b2e1c7a-4f3d-4a9e-9c2b-1d5f8a7e3b04
status: experimental
description: Detects remote file import operations in Concrete CMS that may indicate SSRF abuse via cross-port reuse of a validated DNS pin (CVE-2026-18424).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-18424
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/dashboard/files'
      - '/ccm/system/file'
  selection_import:
    cs-uri-query|contains:
      - 'remote'
      - 'import'
  selection_host:
    cs-uri-query|re: '(https?://[^/&]+):\d+.*(https?://\1)'
  condition: selection_uri and selection_import and selection_host
falsepositives:
  - Legitimate bulk imports from trusted CDNs using the same host on multiple ports
level: medium

YARA Rule

rule CVE_2026_18424_ConcreteCMS_SSRF_Indicator
{
    meta:
        description = "Detects references to Concrete CMS remote URL validation SSRF (CVE-2026-18424) in source or logs"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18424"
        severity = "low"

    strings:
        $cms1 = "concrete" ascii nocase
        $cms2 = "ValidatedRemoteUrl" ascii wide
        $imp1 = "remote_file" ascii nocase
        $imp2 = "file_manager" ascii nocase
        $meta = "169.254.169.254" ascii
        $loop = "127.0.0.1" ascii

    condition:
        filesize < 10MB and
        ($cms1 and $cms2) and
        ($imp1 or $imp2) and
        ($meta or $loop)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-18424 Concrete CMS Remote Import SSRF Possible DNS Rebinding"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/dashboard/files"; http.uri; content:"remote"; http.uri; pcre:"/(https?:\/\/[^\/]+):\d+.*\1/i"; reference:cve,2026-18424; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-18424; classtype:attempted-recon; sid:202618424; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [ network where event.action == "dns_query" and
      dns.question.name : "*" and
      process.name : ("php-fpm", "php", "httpd", "apache2", "nginx") ]
  [ network where event.action == "connection_attempted" and
      destination.ip : ("127.0.0.1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.169.254") and
      process.name : ("php-fpm", "php", "httpd", "apache2", "nginx") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=concrete_cms
("dashboard/files" OR "ccm/system/file") ("remote" OR "import")
| rex field=uri_query "(?<first_url>https?://(?<host>[^/:&]+):\d+)"
| rex field=uri_query max_match=0 "(?<later_urls>https?://[^/&]+:\d+)"
| where isnotnull(host) AND mvcount(later_urls) > 0
| stats count values(later_urls) as urls by src_ip, host, uri_path
| where count > 1

Wazuh OSSEC Rule

<group name="web,concrete_cms,ssrf,">
  <rule id="2026184" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>/dashboard/files</match>
    <regex>remote|import</regex>
    <description>CVE-2026-18424 - Concrete CMS remote file import request (possible SSRF/DNS rebinding)</description>
    <group>attack,cve_2026_18424,</group>
  </rule>
  <rule id="2026185" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/dashboard/files</match>
    <regex>https?://[^/]+:\d+.*https?://\1</regex>
    <description>CVE-2026-18424 - Repeated same-host cross-port remote URL import detected</description>
    <group>attack,cve_2026_18424,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict remote file import permissions to the smallest possible set of trusted roles and disable the feature where it is not operationally required. Egress-filter outbound requests from the CMS host so that loopback, RFC1918, and link-local addresses (including 169.254.169.254) are blocked from being fetched. Avoid multi-URL imports where the same host appears over different ports. Enforce DNS resolution at request time rather than reusing a cached pin, and reject hostnames that resolve to private ranges on re-resolution. Harden cloud metadata access (IMDSv2 with hop limit, or disabled).

2. Patch/upgrade steps. No vendor fix has been identified in tracked sources and the OSV package record is marked unfixed for the affected range. Monitor the Concrete CMS security advisories for a release addressing CVE-2026-18424 and upgrade beyond 9.5.2 once available. Do not override the recorded CVSS score of N/A with third-party values.

3. Long-term hardening. Implement SSRF-safe fetch libraries that re-resolve and re-validate each hop and each port, pin connections to the validated IP at the socket layer, disallow redirects to different hosts, and enforce an allow-list of approved import origins. Segment the web application from internal management planes and cloud metadata services. Log and alert on all server-side outbound fetches initiated by the file manager, and periodically audit import capabilities against the least-privilege principle.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18424
• OSV package record (unfixed): https://osv.dev/ (package b3774abddd475b4ba98b637402506f7a5ebd90ea, unfixed)
• Concrete CMS security advisories: https://www.concretecms.org/security (monitor for a release covering 9.0.0–9.5.2)
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• CISA KEV catalog: not applicable (CVE-2026-18424 is not listed as of the time of writing; no exploit-in-the-wild or threat actor campaign evidence was provided in the source data)