CVE-2026-18424: Concrete CMS SSRF Vulnerability

CVE-2026-18424 Overview

CVE-2026-18424 is a Server-Side Request Forgery (SSRF) vulnerability in Concrete CMS versions 9.0.0 through 9.5.2. The flaw affects the remote file import feature, where the ValidatedRemoteUrl object is reused across multiple URLs sharing the same host. An authenticated user with file import permissions can supply a DNS-rebinding host that passes initial validation against a public address, then resolves to an internal address during the actual download. The server fetches the internal resource and stores the response in the file manager. Concrete CMS assigned this issue a CVSS v4.0 score of 2.1.

Critical Impact
Authenticated attackers can coerce the server into fetching internal-only resources such as loopback services, admin panels, or cloud metadata endpoints, and save the responses to the file manager.

Affected Products

Concrete CMS 9.0.0 through 9.5.2
Fixed in Concrete CMS 9.5.3
Remote file import functionality

Discovery Timeline

Vulnerability reported by Ahmad Wicaksono (sonix03)
2026-09-15 - CVE-2026-18424 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18424

Vulnerability Analysis

CVE-2026-18424 is classified under [CWE-918] Server-Side Request Forgery. The Concrete CMS remote file import feature validates the target URL by resolving its host and confirming that it points to a public address. The result is cached in a ValidatedRemoteUrl object tied to the hostname.

When multiple import URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for each subsequent request. The cached object skips re-validation, and the download step performs a fresh DNS resolution against the attacker-controlled host. This creates a time-of-check to time-of-use gap that enables DNS rebinding across ports and requests.

Root Cause

The root cause is cross-port reuse of a host's validated DNS pin without re-checking the resolved address at fetch time. The validation logic assumes a validated hostname remains safe for later requests, but authoritative DNS servers under attacker control can return different answers for successive queries. The pinning mechanism enforces neither address consistency nor a single-use lifetime.

Attack Vector

An attacker requires an authenticated Concrete CMS account with permission to import remote files. The attacker hosts a DNS server that returns a public IP for the first lookup and a private or loopback IP for the second lookup. The first import triggers validation, which succeeds. A subsequent import against the same host reuses the cached ValidatedRemoteUrl and issues an HTTP request that resolves to an internal target. The response body is written into the Concrete CMS file manager, exposing loopback services, internal admin panels, or cloud instance metadata endpoints such as 169.254.169.254.

The vulnerability manifests in the remote URL validation and reuse logic. See the ConcreteCMS Version 9.5 Release Notes for the vendor's technical description of the fix.

Detection Methods for CVE-2026-18424

Indicators of Compromise

Outbound HTTP requests from the Concrete CMS server to RFC1918 addresses, loopback (127.0.0.0/8), or link-local ranges (169.254.0.0/16).
File manager entries containing responses from internal services, cloud metadata JSON, or admin interface HTML.
Repeated DNS queries from the CMS host for the same external hostname returning divergent answers within short intervals.

Detection Strategies

Inspect web server and application logs for import or remote file actions followed by internal-facing HTTP requests.
Correlate DNS resolver logs with outbound HTTP traffic to identify hostnames whose resolution flips between public and private ranges.
Alert on file manager uploads whose stored content matches signatures of cloud metadata responses or internal service banners.

Monitoring Recommendations

Enforce egress filtering on the CMS server and log all denied connections to internal ranges for review.
Monitor authenticated user activity for accounts that repeatedly invoke the remote file import feature.
Track newly created file manager entries with unusual MIME types or content resembling infrastructure metadata.

How to Mitigate CVE-2026-18424

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which addresses the DNS pin reuse flaw.
Audit user permissions and restrict the remote file import capability to trusted administrators only.
Review file manager contents created since deployment for unexpected internal responses.

Patch Information

Concrete CMS 9.5.3 fixes the SSRF by ensuring each remote URL is validated independently and that the resolved address used for validation matches the address used for the download. Refer to the ConcreteCMS Version 9.5 Release Notes for release details.

Workarounds

Block egress from the Concrete CMS server to RFC1918, loopback, and link-local ranges at the network layer.
Require the CMS host to use a DNS resolver that pins responses or disables short TTLs for external lookups.
Disable the remote file import feature for all non-administrative roles until the patch is applied.

bash

# Example egress restriction using iptables to block metadata and internal ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT