aimeos/pagible

Easy, flexible and powerful cloud-native Laravel CMS package powered by AI with JSON:API, GraphQL API, templates, and themes

View on Packagist

View on Github

Activity

Latest release: 2w ago
Total releases: 41
Cadence: ~7 days
Last 12 months: 23

Reach

Stars: 596

Details

License: MIT
First release: Jun 26, 2025

Releases

Version	Released
`0.13.2` patch	Oct 12, 2026
`0.13.1` patch	Oct 02, 2026
`0.13.0` minor	Sep 30, 2026
`0.12.2` patch	Sep 16, 2026
`0.12.1` patch	Aug 14, 2026
`0.12.0` minor	Aug 07, 2026
`0.11.5` patch	Jul 17, 2026
`0.11.4` patch	Jun 13, 2026
`0.11.2` patch	Jun 10, 2026
`0.11.1` patch	Jun 05, 2026
`0.11.0` minor	Jun 05, 2026
`0.10.4` patch	May 25, 2026
`0.10.3` patch 1 CVE	May 13, 2026
`0.10.2` patch 1 CVE	Apr 26, 2026
`0.10.1` patch 1 CVE	Apr 16, 2026
`0.10.0` minor 1 CVE	Apr 16, 2026
`0.9.4` patch 1 CVE	Mar 12, 2026
`0.9.3` patch 1 CVE	Mar 07, 2026
`0.9.2` patch 1 CVE	Mar 02, 2026
`0.9.1` patch 1 CVE	Feb 28, 2026
`0.9.0` minor 1 CVE	Feb 26, 2026
`0.8.5` patch 1 CVE	Jan 24, 2026
`0.8.4` patch 1 CVE	Jan 02, 2026
`0.8.3` patch 1 CVE	Oct 31, 2025
`0.8.2` patch 1 CVE	Oct 21, 2025
`0.8.1` patch 1 CVE	Oct 17, 2025
`0.8.0` minor 1 CVE	Oct 16, 2025
`0.7.3` patch 1 CVE	Oct 15, 2025
`0.7.2` patch 1 CVE	Oct 06, 2025
`0.7.1` patch 1 CVE	Sep 24, 2025
`0.6.8` patch 1 CVE	Sep 14, 2025
`0.7.0` minor 1 CVE	Sep 14, 2025
`0.6.7` patch 1 CVE	Sep 02, 2025
`0.6.6` patch 1 CVE	Aug 29, 2025
`0.6.5` patch 1 CVE	Aug 26, 2025
`0.6.4` patch 1 CVE	Aug 20, 2025
`0.6.3` patch 1 CVE	Aug 19, 2025
`0.6.2` patch 1 CVE	Aug 14, 2025
`0.6.1` patch 1 CVE	Aug 13, 2025
`0.6.0` minor 1 CVE	Aug 06, 2025
`0.5` initial 1 CVE	Jun 26, 2025

Repository

aimeos/pagible

Forks: 16
Open issues: 8
Language: PHP

api
cms
content-management
content-management-system
contentful
graphql

Dependencies (8)

Depends on

0.13.2

Supply-chain exposure

Known CVEs (1)

CVE-2026-49262 GHSA-mmj8-wcvw-6789 Jun 26, 2026

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

3.0 / 10
Low
Network High Low Required Changed Low None None

Summary

The administrative proxy route (cmsproxy) in Aimeos Pagible CMS is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints.

Details

Before executing an HTTP request to fetch external content, the AdminController::proxy controller validates the target URL using \Aimeos\Cms\Utils::isValidUrl($url). This function performs a DNS query to verify that the hostname does not resolve to private or reserved IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254).

If the validation passes, the application proceeds to the "Use" phase, invoking Guzzle/cURL to send the request. However, Guzzle performs a second DNS lookup to establish the socket connection.

An attacker can exploit this by setting up a malicious DNS server for a domain they control and configuring it with a TTL of 0.

During the validation "Check", the DNS server returns a safe, public IP.

During the Guzzle "Use", the DNS server returns an internal/private IP.

POC

Attacker registers `rebound.test.com with a custom nameserver.

Attacker generates a valid proxy token (assuming basic authenticated access).

Attacker requests /cmsproxy?url=http://rebound.test.com.

isValidUrl checks rebound.test.com. DNS returns 8.8.8.8. Validation passes.

Guzzle requests http://rebound.test.com. DNS returns 169.254.169.254.

The CMS fetches AWS Instance Metadata and returns it to the attacker.

Affected versions

0.10.00.10.10.10.20.10.30.50.6.00.6.10.6.20.6.30.6.40.6.50.6.6

+ 17 more Show less

0.6.70.6.80.7.00.7.10.7.20.7.30.8.00.8.10.8.20.8.30.8.40.8.50.9.00.9.10.9.20.9.30.9.4

Fixed in

0.10.4

References

https://github.com/aimeos/pagible/security/advisories/GHSA-mmj8-wcvw-6789
https://github.com/aimeos/pagible

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 8
patch 32

41 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More