Is CVE-2026-18424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18424 being exploited in the wild.

How severe is CVE-2026-18424?

High severity, with a CVSS score of 7.1, published 15 September 2026.

Is there a fix for CVE-2026-18424?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18424 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18424?

Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18424: Concrete CMS Server-Side Request Forgery in remote file import

CVE-2026-18424 · Severity: high · CVSS 7.1 · Published 2026-09-15

Concrete CMS, a content management system, has a vulnerability in its remote file import feature that allows low-privileged authenticated users to bypass security controls through DNS rebinding. An attacker can trick the server into accessing and downloading sensitive internal resources (such as metadata endpoints, admin panels, or internal services) and save them into the file manager, potentially exposing confidential information or enabling further attacks.

Technologies: Concrete CMS. Vendors: Concrete CMS.

Quick answers

Is CVE-2026-18424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18424 being exploited in the wild.
How severe is CVE-2026-18424?: High severity, with a CVSS score of 7.1, published 15 September 2026.
Which products and versions are affected?: Concrete CMS 9.0.0 to 9.5.2.
Is there a fix for CVE-2026-18424?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18424 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18424?: Check whether you run Concrete CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Server-Side Request Forgery (SSRF) vulnerability in Concrete CMS's remote file import functionality. The root cause is improper DNS pinning validation: when multiple remote URLs share the same hostname, the system caches only the first ValidatedRemoteUrl and reuses it for all subsequent URLs with that host. An authenticated user with file import permissions can exploit this by supplying a DNS-rebinding hostname that resolves to a public address during validation but to a private or loopback address during the actual download, causing the server to fetch internal resources. The attacker can then save the responses (from services like cloud metadata endpoints, internal admin panels, or loopback services) into the file manager. The vulnerability requires authentication, DNS rebinding capability, and precise timing, making it moderately difficult but feasible to exploit.

Affected products

Concrete CMS Concrete CMS 9.0.0 to 9.5.2

Timeline

2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.