CVE-2026-25493
EUVD-2026-684309.02.2026, 20:15
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| craftcms | craft_cms | 4.0.0 < 𝑥 < 4.16.18 |
| craftcms | craft_cms | 5.0.0 < 𝑥 < 5.8.22 |
| craftcms | craft_cms | 4.0.0 |
| craftcms | craft_cms | 4.0.0:rc1 |
| craftcms | craft_cms | 4.0.0:rc2 |
| craftcms | craft_cms | 4.0.0:rc3 |
| craftcms | craft_cms | 5.0.0 |
| craftcms | craft_cms | 5.0.0:rc1 |
𝑥
= Vulnerable software versions