{"id":"CVE-2026-18424","title":"Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin","summary":"Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retain…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-918"],"vendor":"concretecms","product":"concrete_cms","affected":["concrete_cms >= 9.0.0, < 9.5.3"],"patched":["concrete_cms 9.5.3"],"published":"2026-09-15","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:50:50.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-18424","references":[{"url":"https://documentation.concretecms.org/developers/introduction/version-history/953-release-notes","label":"ff5b8ace-8b95-4078-9743-eac1ca5451de"}],"tags":["nvd","cve.org","score-dispute"],"epss":0.00238,"epssPercentile":0.13156,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-20T00:41:04.561434Z"},"scores":{"nvd":7.1,"cna":2.1},"ingestedAt":"2026-09-15T20:44:02.398Z","slug":"CVE-2026-18424","body":"## Overview\n\nConcrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained and reused for every later URL with that host. A low-privileged authenticated user permitted to import files could therefore supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during the unpinned download, causing the server to fetch internal-only resources such as loopback services, internal admin panels, or cloud metadata endpoints and to save the responses into the file manager. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Thanks Ahmad Wicaksono (sonix03) for reporting.\n\n## Affected\n\n- `concrete_cms >= 9.0.0, < 9.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `concrete_cms 9.5.3`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208686,"id":"CVE-2026-18424","ts":1790016693273,"field":"cvss","old":"2.1","new":"7.1"},{"seq":208685,"id":"CVE-2026-18424","ts":1790016693273,"field":"severity","old":"low","new":"high"}]}