CVE-2026-25492
Undergoing Analysis Undergoing Analysis - In Progress
GraphQL SSRF in Craft CMS Allows Internal Data Exposure

Publication date: 2026-02-09

Last updated on: 2026-02-19

Assigner: GitHub, Inc.

Description
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-02-19
Generated
2026-06-16
AI Q&A
2026-02-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25492
EUVD
EUVD-2026-6839
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 3.5.0 (inc) to 4.16.18 (exc)
craftcms craft_cms From 5.0.0 (inc) to 5.8.22 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, update Craft CMS to a patched version. The issue is fixed in versions 4.16.18 and 5.8.22, so upgrading to at least these versions will address the problem.

Executive Summary

This vulnerability exists in Craft CMS versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It involves the save_images_Asset GraphQL mutation, which can be exploited by an authenticated attacker with permission to use this mutation.

The attacker can provide a domain name that resolves to an internal IP address, bypassing hostname validation. If the system allows non-image file extensions such as .txt, the usual image validation checks are bypassed.

This allows the attacker to retrieve sensitive data from internal URLs, including AWS instance metadata credentials from the underlying host.

The issue has been fixed in versions 4.16.18 and 5.8.22.

Impact Analysis

An attacker exploiting this vulnerability can access sensitive internal data by bypassing hostname validation and image validation checks.

Specifically, they can retrieve sensitive information such as AWS instance metadata credentials, which could lead to unauthorized access to cloud resources and further compromise of the system.

This could result in data breaches, unauthorized actions within your infrastructure, and potential loss of control over your environment.

Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25492. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart