Description

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.

INFO

Published Date :

2026-02-09T19:36:58.713Z

Last Modified :

2026-02-10T16:00:35.771Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-25493 vulnerability.

Vendors Products
Craftcms
  • Craft Cms
  • Craftcms
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25493.

URL Resource
https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98 cve-icon cve-icon
https://github.com/craftcms/cms/releases/tag/5.8.22 cve-icon cve-icon
https://github.com/craftcms/cms/security/advisories/GHSA-8jr8-7hr4-vhfx cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact