CVE-2025-68437

Unknown Unknown - Not Provided

SSRF in Craft CMS GraphQL Asset Mutation Enables Data Exposure

Publication date: 2026-01-05

Last updated on: 2026-01-05

Assigner: GitHub, Inc.

Description

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-05

Last Modified

2026-01-05

Generated

2026-07-06

AI Q&A

2026-01-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68437

EUVD

EUVD-2026-0845

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	craft	From 5.0.0 (inc) to 5.8.20 (inc)
craftcms	craft	From 4.0.0 (inc) to 4.16.16 (inc)
craftcms	craft	5.8.21
craftcms	craft	4.16.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to potential data exposure and infrastructure compromise. Attackers can use it to access internal services or cloud metadata endpoints that are normally restricted, fetch sensitive data, and save it as assets that can be accessed and exfiltrated. This could result in unauthorized disclosure of sensitive information and possible further attacks on the infrastructure.

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the Craft CMS GraphQL save_<VolumeName>_Asset mutation. It occurs because the _file input's url parameter allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the url, causing the server to make unauthorized requests to restricted services. The fetched content is then saved as an asset, which can be accessed and exfiltrated.

Mitigation Strategies

Update Craft CMS to the patched versions 5.8.21 or 4.16.17 to mitigate the SSRF vulnerability in the GraphQL save_<VolumeName>_Asset mutation.

Hi! I’m here to help you understand CVE-2025-68437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70