---
id: CVE-2026-49262
title: >-
  In the Aimeos Pagible content management system prior to version 0.10.4, the
  administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request
  Forgery (SSRF) attack via DNS Rebinding
summary: >-
  In the Aimeos Pagible content management system prior to version 0.10.4, the
  administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request
  Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use
  (TOCTOU) …
severity: low
cvss: 3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N'
cwe:
  - CWE-367
  - CWE-918
vendor: aimeos
product: aimeos/pagible
affected:
  - aimeos/pagible < 0.10.4
patched:
  - aimeos/pagible 0.10.4
published: '2026-08-12'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:55:04.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49262'
references:
  - url: >-
      https://github.com/aimeos/pagible/commit/09a8205d513ec89ed22cdd7bdae0f4c181cee082
    label: security-advisories@github.com
  - url: 'https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789'
    label: security-advisories@github.com
  - url: 'https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-mmj8-wcvw-6789'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00131
epssPercentile: 0.03095
ecosystem: composer
ingestedAt: '2026-06-29T13:24:35.115Z'
---

## Overview

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49262)

Affected packages:

- `aimeos/pagible < 0.10.4`

Patched in:

- `aimeos/pagible 0.10.4`

Source: https://github.com/advisories/GHSA-mmj8-wcvw-6789