CVE-2026-18424 Concrete CMS CVE debrief

Who should care

Concrete CMS administrators and security teams should assess exposure and prioritize remediation for instances with untrusted users permitted to import files. This involves verifying inventory, monitoring for suspicious activity, and ensuring appropriate compensating controls are in place for exposed systems.

Why it matters

A low-privileged authenticated user in Concrete CMS 9.0.0 to 9.5.2 can exploit a Server-Side Request Forgery (SSRF) vulnerability via cross-port reuse of a host's validated DNS pin, allowing them to import files and potentially access internal resources. Concrete CMS administrators and security teams should assess exposure and prioritize remediation for instances with untrusted users permitted to import files. The vulnerability allows a low-privileged authenticated user to supply a DNS-rebinding host that resolves to a public address during validation and to a private or loopback address during the unpinned download, potentially causing the server to fetch internal-only resources.

• Potential access to internal resources such as loopback services, internal admin panels, or cloud metadata endpoints
• Possible data exposure or unauthorized access to sensitive information
• Risk of lateral movement or further exploitation within the network
• Need for verification of affected versions and remediation status

Technical summary

The vulnerability is caused by the reuse of a host's validated DNS pin for multiple remote URLs, allowing a low-privileged authenticated user to supply a DNS-rebinding host that resolves to a public address during validation and to a private or loopback address during the unpinned download. This issue arises in Concrete CMS versions 9.0.0 to 9.5.2, where a user's validated DNS pin is retained and reused for every later URL with that host, enabling potential access to internal resources through file import functionality.

Defensive priority

Assess exposure and prioritize remediation for Concrete CMS instances with untrusted users permitted to import files.

Recommended defensive actions

• Assess exposure and prioritize remediation for Concrete CMS instances with untrusted users permitted to import files
• Verify inventory of Concrete CMS instances and check for untrusted users with file import permissions
• Monitor for suspicious file import activity and internal resource access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows a low-privileged authenticated user to supply a DNS-rebinding host that resolves to a public address during validation and to a private or loopback address during the unpinned download, potentially causing the server to fetch internal-only resources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.