Statamic Vulnerable to Server-Side Request Forgery via Glide

CAO 8.6CVE-2026-28423 · GHSA-cwpp-325q-2cvp · Công bố 27/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-28423 là lỗ hổng mức CAO (CVSS 8.6) ảnh hưởng statamic/cms, statamic (statamic).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.43%, cao hơn 36.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.0, 5.73.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
statamic/cms Packagist	`≥ 6.0.0-alpha.1, < 6.4.0< 5.73.11`	`6.4.05.73.11`
statamic statamic	`≥ 6.0.0, < 6.4.0< 5.73.11`	`6.4.05.73.11`

Mô tả

Impact

When Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server.

Patches

This has been fixed in 5.73.11 and 6.4.0.

Mô tả của NVD

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.