CVE-2026-49262

CVE-2026-49262 : Aimeos Pagible CMS before version 0.10.4 exposes the administrative proxy route cmsproxy to a Server-Side Request Forgery (SSRF) via DNS rebinding. A TOCTOU race between URL validation and the actual HTTP request allows an attacker to access internal network resources and cloud m...

EUVD-2026-57218

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...

CVE-2026-49262: Time-of-check Time-of-use (TOCTOU) Race Condition

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route cmsproxy is vulnerable to a Server-Side Request Forgery SSRF attack via DNS Rebinding. A Time-of-Check to Time-of-Use TOCTOU race condition exists between the URL validation phase and the actua...

PT-2026-53023

Name of the Vulnerable Software and Affected Versions Aimeos Pagible versions prior to 0.10.4 Description The administrative proxy route /cmsproxy is susceptible to Server-Side Request Forgery SSRF through DNS Rebinding. This occurs due to a Time-of-Check to Time-of-Use TOCTOU race condition—a...