CVE-2026-32279: 
PHP vulnerability analysis and mitigation

CVE-2026-32279 is a Server-Side Request Forgery (SSRF) vulnerability in the external page migration feature of the Page Management Plugin in Connect-CMS, an open-source content management system. It affects all 1.x series versions up to and including 1.41.0, and all 2.x series versions up to and including 2.41.0. The vulnerability was disclosed on March 23, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and stems from insufficient validation of user-supplied URLs in the external page migration feature of the Page Management Plugin. Prior to the fix, the application did not enforce restrictions on whether the supplied URL resolved to a global (non-private, non-reserved) address, allowing an authenticated administrator to supply internal or loopback URLs that the server would then fetch. The patch introduced a UrlUtils::isGlobalHttpUrl() validation check applied at multiple points — including initial URL input, redirect destinations, and resource download paths — to reject non-global addresses (GitHub Commit 617a874, GitHub Commit 4a1a64a). Exploitation requires privileges sufficient to access the page management screen, meaning the attacker must hold a high-privilege account (GitHub Advisory).

Successful exploitation allows a high-privileged attacker to force the Connect-CMS server to issue HTTP requests to internal network resources that would otherwise be inaccessible from the internet, potentially exposing sensitive internal services, metadata endpoints (e.g., cloud instance metadata), or confidential data. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself to internal infrastructure. Integrity and availability are not directly impacted; the primary risk is confidentiality breach through unauthorized access to internal destinations (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027%, reflecting a very low probability of exploitation in the near term. Exploitation is further constrained by the requirement for high-level (administrative) privileges on the Connect-CMS instance.

1. Gain administrative access: Obtain credentials for a Connect-CMS account with page management privileges, either through credential theft, phishing, or reuse of compromised credentials.
2. Navigate to the Page Management Plugin: Log into the Connect-CMS admin panel and access the Page Management Plugin's external page migration feature.
3. Supply a malicious internal URL: In the migration source URL field, enter an internal or loopback address (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://192.168.1.1/admin) instead of a legitimate external page URL.
4. Trigger the migration request: Submit the migration form, causing the server to issue an HTTP GET request to the attacker-controlled internal URL.
5. Retrieve the response: The server fetches the internal resource and may expose its contents through the migration output, error messages, or stored migration files, allowing the attacker to read sensitive internal data (GitHub Advisory, GitHub Commit 617a874).

• Logs: Connect-CMS application logs showing HTTP GET requests initiated by the migration feature to private IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or loopback addresses (127.0.0.1); log entries from migrationHtmlPage or migrationNC3Page functions referencing internal URLs.
• Network: Outbound HTTP requests from the web server process to internal network addresses or cloud metadata endpoints (e.g., 169.254.169.254) originating from the Connect-CMS application server.
• File System: Unexpected files in the storage/app/migration/import/pages/ directory containing content from internal services rather than legitimate external web pages.
• Logs: Web server access logs showing POST requests to the page migration endpoint (/manage/page/migrationOrder/) with URL parameters pointing to non-public addresses.

The primary remediation is to upgrade Connect-CMS to version 1.41.1 (for the 1.x series) or 2.41.1 (for the 2.x series), both released on March 23, 2026 (v1.41.1 Release, v2.41.1 Release). As a workaround prior to patching, restrict access to the Page Management Plugin to the minimum number of trusted administrators and implement network-level controls to prevent the application server from making outbound requests to internal network ranges. Additionally, deploying a web application firewall or egress filtering to block server-side requests to private/reserved IP ranges can reduce risk while an upgrade is pending (GitHub Advisory).

The vulnerability was reported by 小田切 祥 (Sho Odagiri) of GMO Cybersecurity by Ierae, Inc., and credited in the official advisory (GitHub Advisory). No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed for this CVE.