Concrete CMS versions 9.0.0 through 9.5.2 contain a Server-Side Request Forgery (SSRF) vulnerability involving remote file import and DNS pin reuse. A low-privileged authenticated user allowed to import files can exploit this by supplying a DNS-rebinding host that resolves differently during validation and download, enabling access to internal resources. The vulnerability has a low CVSS v4.0 score of 2.1.