CVE-2026-49262: 
PHP vulnerability analysis and mitigation

CVE-2026-49262 is a Server-Side Request Forgery (SSRF) vulnerability via DNS Rebinding in the administrative proxy route (cmsproxy) of Aimeos Pagible CMS. It affects all versions of aimeos/pagible prior to 0.10.4 (Composer package). The vulnerability was first published on May 25, 2026, and added to the GitHub Advisory Database on June 26, 2026. It carries a CVSS v3.1 base score of 3.0 (Low) (GitHub Advisory, Aimeos Advisory).

The root cause is a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) combined with SSRF (CWE-918) in the AdminController::proxy controller. The \Aimeos\Cms\Utils::isValidUrl($url) function performs a DNS lookup during validation to block requests to private/reserved IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254), but Guzzle/cURL performs a second, independent DNS lookup when establishing the actual socket connection. An attacker controlling a DNS server for their domain can configure a TTL of 0, returning a benign public IP during the validation check and a private/internal IP (e.g., the AWS metadata endpoint 169.254.169.254) during the subsequent Guzzle request, bypassing the SSRF protection entirely (GitHub Advisory, Aimeos Advisory).

Successful exploitation allows an authenticated attacker to cause the CMS server to fetch internal network resources or cloud metadata endpoints (such as AWS Instance Metadata at 169.254.169.254) and return their contents to the attacker. The primary impact is a low-severity confidentiality breach — exposure of internal service data, cloud credentials, or infrastructure metadata — with no integrity or availability impact. In cloud-hosted environments, leaked instance metadata could enable privilege escalation or lateral movement by exposing IAM role credentials (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-49262. Exploitation requires low privileges (authenticated access to generate a proxy token) and user interaction, and the attack complexity is rated High due to the timing requirements of the DNS rebinding race condition. The CVE status remains "Reserved" and no EPSS score or CISA KEV listing is currently available (GitHub Advisory, Aimeos Advisory).

1. Setup malicious DNS infrastructure: Register a domain (e.g., rebound.attacker.com) with a custom authoritative nameserver configured to respond with a TTL of 0, enabling rapid DNS record changes.
2. Configure DNS rebinding: Program the nameserver to return a legitimate public IP (e.g., 8.8.8.8) on the first DNS query and a target internal IP (e.g., 169.254.169.254 for AWS metadata) on subsequent queries.
3. Obtain authenticated access: Acquire low-privilege credentials to the Aimeos Pagible CMS admin interface and generate a valid proxy token for the cmsproxy route.
4. Send crafted proxy request: Submit a request to /cmsproxy?url=http://rebound.attacker.com — the isValidUrl() check resolves the domain to the public IP and passes validation.
5. Trigger DNS rebinding: When Guzzle/cURL performs its own DNS lookup to establish the connection, the nameserver now returns 169.254.169.254 (or another internal IP).
6. Retrieve internal data: The CMS server fetches the AWS Instance Metadata Service (IMDS) or other internal resource and returns the response body (including IAM credentials or other sensitive data) to the attacker (GitHub Advisory, Aimeos Advisory).

• Network: Outbound HTTP requests from the CMS server to 169.254.169.254 (AWS IMDS), 100.100.100.200 (Alibaba Cloud metadata), or other cloud metadata endpoints; DNS queries for attacker-controlled domains with TTL=0 responses observed in DNS logs.
• Logs: Web server or application logs showing requests to /cmsproxy with external URLs resolving to private/reserved IP ranges; repeated DNS resolution failures or rapid TTL expiry for the same hostname in a short window.
• Network: Unexpected outbound connections from the CMS application process to RFC 1918 address space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16).

Upgrade aimeos/pagible to version 0.10.4 or later, which contains the patch for this vulnerability. As a workaround prior to patching, restrict network-level access to cloud metadata endpoints (e.g., block outbound connections to 169.254.169.254) via firewall rules or security groups, and limit access to the /cmsproxy admin route to trusted users only. Implementing DNS pinning or using a DNS resolver that enforces consistent responses within a request lifecycle would also mitigate the TOCTOU race condition (GitHub Advisory, Aimeos Advisory).