CVE-2026-32279
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Record
CVE-2026-32279- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-14573
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Record
EUVD-2026-14573- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jh46-85jr-6ph9
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Security Advisory — Page Management Plugin (SSRF)
Summary
A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin.
Affected Versions
- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0
Patched Versions
- 1.41.1
- 2.41.1
Description
In the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version.
Solution
Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later.
Credits
OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
- Record
GHSA-jh46-85jr-6ph9- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Record
CVE-2026-32279- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
- Record
CVE-2026-32279- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-jh46-85jr-6ph9
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
Security Advisory — Page Management Plugin (SSRF)
Summary
A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin.
Affected Versions
- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0
Patched Versions
- 1.41.1
- 2.41.1
Description
In the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version.
Solution
Update to the fixed version. For the 1.x series, update to 1.41.1 or later. For the 2.x series, update to 2.41.1 or later.
Credits
OpenSource WorkShop thanks Sho Odagiri (小田切 祥) of GMO Cybersecurity by Ierae, Inc. for reporting this vulnerability.
- Record
GHSA-jh46-85jr-6ph9- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensource-workshop/connect-cmsPackagist |
through 1.41.0 | 1.41.1 |
opensource-workshop/connect-cmsPackagist |
2.0.0 to 2.41.0 | 2.41.1 |
opensource-workshop/connect-cmsPackagist |
before 1.41.1, plus listed versions 1.20.0v0.0.1.20200106v0.0.1.20200216v0.0.1.20200302v0.0.1.20200411 Show 45 moreShow lessv0.0.1.20200510v0.0.1.20200603v0.0.1.20200716v0.0.1.20200909v0.0.1.20201008v0.0.1.20201207v0.0.1.20210104v0.0.1.20210301v0.0.1.20210405v0.0.1.20211130v0.0.1.20220207v1.0.0v1.1.0v1.1.1v1.1.2v1.1.3v1.10.0v1.10.1v1.10.2v1.10.3v1.10.4v1.11.0v1.11.1v1.11.2v1.11.3v1.11.4v1.11.5v1.12.1v1.12.2v1.12.3v1.13.0v1.13.1v1.14.0v1.14.1v1.14.2v1.15.0v1.15.1v1.15.2v1.15.3v1.15.4v1.16.0v1.17.0v1.17.1v1.17.2v1.17.3 |
1.41.1 |
opensource-workshop/connect-cmsPackagist |
2.0.0 up to 2.41.1, plus listed versions 2.30.0v2.0.0v2.0.2v2.0.3v2.0.4 Show 45 moreShow lessv2.1.0v2.1.1v2.1.2v2.1.3v2.10.0v2.10.1v2.10.2v2.15.0v2.15.1v2.15.2v2.15.3v2.15.4v2.16.0v2.17.0v2.17.1v2.17.2v2.17.3v2.17.4v2.18.0v2.18.1v2.18.2v2.18.3v2.19.0v2.19.2.1v2.2.0v2.2.1v2.2.2v2.21.0v2.22.0v2.23.0v2.23.2v2.23.3v2.24.0v2.25.0v2.25.1v2.26.0v2.26.1v2.27.0v2.27.0.1v2.28.0v2.29.0v2.29.1v2.3.0v2.3.1v2.3.2 |
2.41.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32279 is a medium vulnerability (CVSS 6.8) in Opensource-workshop Connect-cms, published March 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in opensource-workshop/connect-cms 1.41.1.
References
github.com/opensource-workshop/connect-cms/security/advisories/GHSA-jh46-85jr-6ph9
nvd.nist.gov/vuln/detail/CVE-2026-32279
Left out here: 138 versions. The JSON record has them.