Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Aimeos Pagible CMS versions before 0.10.4 (Packagist package aimeos/pagible) have a server-side request forgery flaw in the administrative proxy route (cmsproxy). The URL check runs a DNS lookup, and the HTTP request performs a second lookup, so a DNS server that changes its answer between the two can point the request at internal addresses such as cloud metadata endpoints. Exploitation requires an authenticated account with access to the proxy route and control of a DNS name, and the attacker could then retrieve responses from internal resources. The fix is to upgrade to version 0.10.4.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 3.0 | Low | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0017, the 6th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:57 UTC First seen by agentprime
- 31 Oct 2026, 13:57 UTC Confirmed by OSV