6.8

CVE-2026-32279

Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensource-workshop ≫ Connect-cms Version >= 1.0.0 < 1.41.1
Opensource-workshop ≫ Connect-cms Version >= 2.0.0 < 2.41.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.264
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.8 2.3 4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://github.com/opensource-workshop/connect-cms/releases/tag/v1.41.1
Release Notes
https://github.com/opensource-workshop/connect-cms/releases/tag/v2.41.1
Release Notes
https://github.com/opensource-workshop/connect-cms/security/advisories/GHSA-jh46-85jr-6ph9
Vendor Advisory
https://github.com/opensource-workshop/connect-cms/commit/4a1a64a8f768a53e06a4239e25782d9e2e88fc63
Patch
https://github.com/opensource-workshop/connect-cms/commit/617a874e14b8476da7c0760a06384b9da21bdd4f
Patch