Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first validated URL is retained and reused for subsequent URLs with that host. An attacker with low-privileged authenticated access and file import rights can supply a DNS-rebinding host that resolves to a public IP during validation but to a private or loopback IP during the actual download. This causes the server to fetch internal-only resources and save their responses into the file manager. The vulnerability is tracked as CVE-2026-18424 and has a CVSS v4.0 score of 2.1.

An attacker with low-privileged authenticated access and permission to import files can exploit this SSRF vulnerability to cause the server to access internal resources that are normally inaccessible externally, such as loopback services, internal admin panels, or cloud metadata endpoints. The fetched data is saved into the file manager, potentially exposing sensitive internal information. However, the overall severity is low due to the required privileges and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file import permissions to trusted users only and monitor for suspicious file import activity related to unusual internal resource access patterns.