CVE-2026-49262

Executive Summary

CVE-2026-49262 is a Server-Side Request Forgery (SSRF) vulnerability in the Aimeos Pagible content management system, affecting all deployments prior to version 0.10.4. The flaw resides in the administrative proxy route cmsproxy, where a Time-of-Check to Time-of-Use (TOCTOU) race condition between URL validation and the actual HTTP request can be exploited with DNS rebinding to reach internal network resources and cloud metadata endpoints. The direct impact is a low confidentiality leak (CVSS base score 3.0), but in cloud-hosted environments the exposure of instance metadata credentials can materially amplify the blast radius beyond the CMS itself.

Technical Analysis

The vulnerability class is SSRF with a TOCTOU race condition, assigned CWE-367. The affected component is the administrative proxy route named cmsproxy in the Aimeos Pagible CMS, which is present in all versions prior to 0.10.4.

The cmsproxy route functions as a server-side proxy: it accepts a URL and instructs the Pagible server's HTTP client to fetch that URL on the caller's behalf. Such a route is presumably intended to let administrators retrieve remote content for CMS operations. A proper SSRF defense requires the application to verify that the target address is safe (i.e., not loopback, not an RFC1918 private range, and not the link-local cloud metadata address 169.254.169.254). In Pagible versions prior to 0.10.4, the NVD description confirms that this validation occurs in a separate phase from the actual HTTP request, and that a race condition exists between the two phases.

Attackers weaponize this race with the well-known DNS rebinding technique. The attacker registers a domain, e.g., attacker-controlled.example, and configures its authoritative DNS server to alternate between two A records: one for a benign public IP address (the value the validation phase will see) and one for an internal target such as 169.254.169.254 or an address within the RFC1918 space. When the Pagible server resolves the hostname during the URL validation phase, it receives the benign public answer and the check passes. When the application's HTTP client later resolves the same hostname during the request phase — a second DNS query, moments later — it receives the internal answer, and the server-side fetch is sent to the internal resource. Because both lookups use the same fully qualified domain name, hostname-based allowlists and deny lists are defeated. Only an atomic, request-time validation of the resolved IP address is effective, and that check is precisely what the TOCTOU gap bypasses.

The attack surface is constrained by the CVSS vector: network reachability (AV:N), high attack complexity (AC:H) due to the race timing, low privilege requirement (PR:L), and required user interaction (UI:R). The proxy route is administrative in nature, so an attacker needs some authenticated access to the Pagible web interface or must trick an authenticated administrator into triggering the request (e.g., by clicking a crafted link). The scope is changed (S:C) because the compromised component reaches resources beyond its intended security boundary — namely the internal network and cloud metadata plane. Impact is limited to low confidentiality loss (C:L) with no integrity or availability impact (I:N, A:N).

No additional implementation details — function names, class names, parameter names, or code paths — are disclosed in the NVD description or CNA title. Insufficient technical detail is available to describe the validation logic or the HTTP request construction more precisely. The mechanism described above is the standard DNS-rebinding SSRF pattern and is consistent with the confirmed details in the advisory data.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is reported for CVE-2026-49262; the attack chain below is inferred from the vulnerability class and the NVD description and should be treated as analytical, not empirically confirmed.

1. Reconnaissance / target identification. The attacker fingerprints exposed Aimeos Pagible instances to identify versions prior to 0.10.4. Version disclosure in HTTP response headers, asset manifests, or CMS-specific error pages may suffice. The attacker also identifies whether the instance runs in a cloud environment (e.g., AWS, GCP, Azure) where the metadata endpoint 169.254.169.254 is reachable, since this maximizes the value of the SSRF.

2. Triggering the flaw. The attacker registers a DNS-rebinding domain and configures the DNS server to return alternating A records (benign public IP first, internal IP on subsequent queries). The attacker authenticates with a low-privileged account on the Pagible instance — or, given the UI:R requirement, lures an authenticated administrator into interacting with a crafted link/URL — and supplies the malicious URL to the cmsproxy route.

3. Execution at the vulnerability-class level. The Pagible server performs URL validation while the hostname resolves to the benign public IP, so the request is accepted. The server's HTTP client then re-resolves the hostname for the actual outbound request and receives the internal address. The proxy fetches the internal resource — for example, sending an HTTP GET to the cloud metadata service at 169.254.169.254 or to internal web applications on the RFC1918 network. The TOCTOU window between validation and request is the critical race the attacker must time.

4. Post-exploitation impact. The response body of the server-side request is relayed back to the attacker. Internal web applications may expose configuration data, credentials, or internal service information. In cloud environments, the metadata endpoint can return IAM temporary credentials, including the access key ID, secret access key, and session token, which the attacker can use to call cloud APIs outside the CMS boundary. The SSRF itself is read-only (C:L, I:N, A:N), so it does not directly enable code execution or data modification, but leaked cloud credentials can be used for subsequent lateral movement and resource abuse.

Impact Assessment

The direct business impact of CVE-2026-49262 is limited information disclosure. The CVSS subscores confirm this: confidentiality impact is low — the attacker gains read access to restricted resources but not full content integrity or system control. Integrity and availability are unaffected. The scope component (S:C) is the most consequential element: the SSRF escapes the security scope of the CMS process and reaches the internal network, where the blast radius is defined entirely by what internal services and metadata endpoints are reachable from the Pagible server.

Deployments most exposed are:

• Aimeos Pagible instances running in IaaS/PaaS environments where 169.254.169.254 metadata access is unfiltered, because IAM credential theft is a credible escalation path.
• Instances co-located with internal applications that lack authentication or that trust the internal network boundary.
• Environments with flat network segmentation, where the CMS server can reach database ports, configuration management endpoints, or internal admin panels.

The practical severity should not be dismissed solely because of the 3.0 base score. The EPSS probability score of 0.00131 (3.1st percentile) and the absence of a CISA KEV listing indicate no observed in-the-wild exploitation and a low near-term exploitation likelihood. However, the vulnerability is trivially weaponizable once a target is identified, and the potential for cloud credential leakage makes remediation worthwhile even at low severity.

Detection Guidance

Detection of DNS-rebinding SSRF is challenging from server-side access logs alone, because the logged hostname is attacker-controlled and appears benign; the internal IP address is only visible in the outbound connection from the Pagible server to the internal resource. The most reliable detections are therefore network-layer rules that flag outbound HTTP connections from the CMS server toward 169.254.169.254 or RFC1918 addresses, plus web-log rules that match cmsproxy requests whose query content references internal IP literals or unusual encoded addresses.

Sigma Rule

title: Aimeos Pagible cmsproxy SSRF Attempt via DNS Rebinding
id: 7f3c5a1e-9d42-4b6a-8e21-0c6a1f3b9d21
status: experimental
description: Detects HTTP requests to the Aimeos Pagible administrative proxy route cmsproxy whose target references internal IP ranges or cloud metadata endpoints, indicative of SSRF exploitation (CVE-2026-49262).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-49262
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    definition: Access logs from the reverse proxy or web server fronting the Aimeos Pagible instance
detection:
    selection_route:
        cs-uri-query|contains: cmsproxy
    selection_target:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '127.0.0.1'
            - 'localhost'
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
    condition: selection_route and selection_target
fields:
    - c-ip
    - cs-uri-query
    - sc-status
falsepositives:
    - Legitimate administrative use of the proxy route to fetch internal resources (should be rare and reviewed)
level: high

YARA Rule

rule CVE_2026_49262_Aimeos_Pagible_cmsproxy_SSRF
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects attacker tooling or interceptor payloads targeting CVE-2026-49262, an SSRF via DNS rebinding in the Aimeos Pagible cmsproxy route"
        cve = "CVE-2026-49262"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-49262"
        date = "2026-01-01"
    strings:
        $route = "cmsproxy" ascii nocase
        $meta = "169.254.169.254" ascii
        $loopback_hex = "0x7f000001" ascii
        $rebind_a = "rebind" ascii nocase
        $rebind_b = "dns" ascii nocase
        $rebind_c = "ttl" ascii nocase
    condition:
        $route and ($meta or $loopback_hex) and 1 of ($rebind_a, $rebind_b, $rebind_c)
}

Suricata IDS Rule

# Rule 1: Detect the CMS server reaching the cloud metadata endpoint (strong SSRF indicator)
alert http $HOME_NET any -> 169.254.169.254 any (msg:"CVE-2026-49262 Aimeos Pagible SSRF - outbound HTTP to cloud metadata endpoint"; flow:to_server,established; http.method; content:"GET"; metadata:mitre_technique_id T1190; sid:10049261; rev:1;)

# Rule 2: Detect cmsproxy requests containing an internal IP literal in the URL
alert http any any -> $HOME_NET any (msg:"CVE-2026-49262 Aimeos Pagible cmsproxy SSRF - internal target in request"; http.uri; content:"cmsproxy"; http.uri; content:"169.254.169.254"; sid:10049262; rev:1;)

Elastic Detection

any where event.category == "web" and
  wildcard(url.path, "*cmsproxy*") and
  (
    wildcard(url.full, "*169.254.169.254*") or
    wildcard(url.full, "*127.0.0.1*") or
    wildcard(url.full, "*10.*") or
    wildcard(url.full, "*192.168.*") or
    wildcard(url.full, "*172.16.*") or
    wildcard(url.full, "*172.17.*") or
    wildcard(url.full, "*172.18.*") or
    wildcard(url.full, "*172.19.*") or
    wildcard(url.full, "*172.20.*") or
    wildcard(url.full, "*172.21.*") or
    wildcard(url.full, "*172.22.*") or
    wildcard(url.full, "*172.23.*") or
    wildcard(url.full, "*172.24.*") or
    wildcard(url.full, "*172.25.*") or
    wildcard(url.full, "*172.26.*") or
    wildcard(url.full, "*172.27.*") or
    wildcard(url.full, "*172.28.*") or
    wildcard(url.full, "*172.29.*") or
    wildcard(url.full, "*172.30.*") or
    wildcard(url.full, "*172.31.*") or
    wildcard(url.full, "*localhost*")
  )

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*cmsproxy*"
| eval target=lower(uri_query)
| eval is_internal=case(
    like(target,"%169.254.169.254%"), "cloud_metadata",
    like(target,"%192.168.%"), "rfc1918",
    like(target,"%10.%"), "rfc1918",
    like(target,"%127.0.0.1%"), "loopback",
    like(target,"%localhost%"), "loopback",
    like(target,"%172.16.%") OR like(target,"%172.17.%") OR like(target,"%172.18.%") OR like(target,"%172.19.%") OR like(target,"%172.20.%") OR like(target,"%172.21.%") OR like(target,"%172.22.%") OR like(target,"%172.23.%") OR like(target,"%172.24.%") OR like(target,"%172.25.%") OR like(target,"%172.26.%") OR like(target,"%172.27.%") OR like(target,"%172.28.%") OR like(target,"%172.29.%") OR like(target,"%172.30.%") OR like(target,"%172.31.%"), "rfc1918",
    1=1, "external")
| where is_internal!="external"
| stats count by src_ip, uri, uri_query, is_internal, sc_status
| sort - count

Wazuh OSSEC Rule

<group name="web,cms,pagible,">
  <rule id="100492" level="12">
    <decoded_as>web</decoded_as>
    <match>cmsproxy</match>
    <regex>169\.254\.169\.254|127\.0\.0\.1|localhost|192\.168\.|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.</regex>
    <description>Aimeos Pagible cmsproxy SSRF attempt - request targets internal or cloud metadata address (CVE-2026-49262)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,pagible,cve_2026_49262,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 — CLAIMED: a single source (OSV) claims that version 0.10.4 fixes the issue. This has not been independently confirmed, and the vendor fix and workaround fields are listed as N/A in the available data. The absence of a CISA KEV entry means no known in-the-wild exploitation as of this writing.

1. Immediate mitigations.

   • Restrict access to the cmsproxy administrative route at the reverse proxy / WAF layer to only trusted administrators; if the proxy feature is not in business use, disable it entirely.
   • Block outbound HTTPS/HTTP egress from the Pagible server to 169.254.169.254 and to RFC1918 ranges at the network firewall or cloud security group level. This directly neutralizes the SSRF regardless of the application-level race condition.
   • Enforce DNS pinning or split-horizon DNS controls if the deployment supports them, so that server-side resolution of public hostnames cannot return internal addresses.

2. Patch / upgrade steps.

   • Upgrade Aimeos Pagible to version 0.10.4 or later. Verify the upgrade in a staging environment before production rollout, and independently confirm the patch resolves the TOCTOU window described in the advisory, given the patch confidence level.
   • After upgrade, retest the cmsproxy route with a DNS-rebinding proof of concept (e.g., a domain that alternates between an external IP and 127.0.0.1) to confirm the internal request is blocked.

3. Long-term hardening.

   • Implement SSRF-safe proxy architecture: perform a single DNS resolution and validate the resulting IP at request time; reject loopback, link-local, and RFC1918 addresses server-side; re-validate the IP immediately before the connection is made and reject mismatches to defeat rebinding.
   • Apply network segmentation so the CMS tier cannot reach internal management interfaces or other application tiers directly.
   • Continuously monitor server-side outbound connections toward internal ranges and cloud metadata endpoints; alert on any such traffic as a high-severity anomaly.
   • Track the OSV advisory and vendor release notes for independent confirmation or for a follow-up advisory if the claimed patch is later disputed.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-49262
• OSV Vulnerability Record (patch source): https://osv.dev/vulnerability/CVE-2026-49262
• CWE-367 (Time-of-check Time-of-use Race Condition): https://cwe.mitre.org/data/definitions/367.html
• ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-49262 is not listed (no known exploitation in the wild as of this report)

No threat-actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-49262.