CVE-2026-6983: Pagekit CMS SSRF Vulnerability

CVE-2026-6983 Overview

CVE-2026-6983 is a server-side request forgery (SSRF) vulnerability affecting Pagekit versions up to 1.0.18. The flaw resides in the /index.php/admin/system/update/download endpoint, where the url parameter is not properly validated before being used to issue a server-side HTTP request. An authenticated attacker with high privileges can manipulate the url argument to coerce the Pagekit server into making requests to arbitrary destinations. Public exploit details are available, and the vendor did not respond to disclosure attempts. The weakness is classified as [CWE-918].

Critical Impact
Authenticated attackers can abuse the Pagekit admin update mechanism to send crafted HTTP requests from the server, enabling internal network reconnaissance and interaction with otherwise unreachable services.

Affected Products

Pagekit CMS versions up to and including 1.0.18
Pagekit administrative update component (/index.php/admin/system/update/download)
Deployments exposing the Pagekit admin interface to untrusted networks

Discovery Timeline

2026-04-25 - CVE-2026-6983 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-6983

Vulnerability Analysis

The vulnerability stems from unsanitized user input passed to the Pagekit update download routine. The administrative endpoint /index.php/admin/system/update/download accepts a url parameter that controls the destination of a server-initiated HTTP request. Because Pagekit does not enforce an allowlist of trusted update hosts or filter internal address ranges, the application fetches arbitrary URLs supplied by the caller.

Exploitation requires authenticated access with administrator-level privileges, which limits the attack surface. However, once authenticated, the attacker can pivot through the application to interact with internal services, cloud metadata endpoints, or loopback interfaces. The request originates from the Pagekit server, bypassing perimeter network controls.

The scope of impact is constrained because the SSRF returns limited response data to the attacker and does not directly grant code execution. Confidentiality, integrity, and availability impacts are low, reflecting the bounded nature of the update download workflow.

Root Cause

The root cause is improper validation of a user-controlled URL before performing a server-side fetch [CWE-918]. The update handler treats the url parameter as a trusted input and dispatches an outbound request without restricting protocols, hostnames, or IP ranges.

Attack Vector

An authenticated administrator submits a crafted request to /index.php/admin/system/update/download with the url parameter set to an internal resource such as http://127.0.0.1:8080/ or a cloud metadata service. The Pagekit backend resolves and contacts the supplied destination, allowing the attacker to probe internal infrastructure. No specific exploitation code has been verified for inclusion; refer to the VulDB Vulnerability #359526 entry for additional technical detail.

Detection Methods for CVE-2026-6983

Indicators of Compromise

Outbound HTTP requests originating from the Pagekit web server directed at internal IP ranges (RFC1918) or loopback addresses
Access log entries for /index.php/admin/system/update/download containing unexpected values in the url query parameter
Connections from the Pagekit host to cloud metadata endpoints such as 169.254.169.254

Detection Strategies

Inspect web server access logs for administrative download requests where the url parameter does not point to the official Pagekit update server
Correlate authenticated admin sessions with outbound traffic generated by the PHP process to identify anomalous fetch destinations
Apply web application firewall rules that flag requests to the update endpoint containing internal hostnames, IP literals, or non-HTTPS schemes

Monitoring Recommendations

Monitor egress traffic from Pagekit hosts and alert on connections to private network ranges or cloud metadata services
Track repeated calls to /index.php/admin/system/update/download from the same session as an indication of SSRF probing
Review administrator account activity for unexpected use of the update download functionality

How to Mitigate CVE-2026-6983

Immediate Actions Required

Restrict access to the Pagekit administrative interface using network-level controls, VPN, or IP allowlisting
Audit and reduce the number of accounts holding administrator privileges in Pagekit
Rotate credentials for any administrator account suspected of compromise

Patch Information

No vendor patch is available. According to the disclosure record, the Pagekit maintainers were contacted but did not respond. Organizations should treat affected deployments as unsupported and plan migration to a maintained content management platform. Refer to VulDB Submission #796163 and the Yuque Security Documentation for the disclosure details.

Workarounds

Block external access to /index.php/admin/system/update/download at the reverse proxy or web application firewall layer
Configure egress filtering on the Pagekit host to deny outbound connections to internal subnets, loopback, and cloud metadata addresses
Disable the in-product update mechanism and apply updates manually from a trusted source

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location ~* ^/index\.php/admin/system/update/download {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}