CVE-2026-25493
Undergoing Analysis Undergoing Analysis - In Progress
SSRF Bypass via Redirects in Craft Platform saveAsset Mutation

Publication date: 2026-02-09

Last updated on: 2026-02-19

Assigner: GitHub, Inc.

Description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-09
Last Modified
2026-02-19
Generated
2026-06-16
AI Q&A
2026-02-09
EPSS Evaluated
2026-06-14
NVD
CVE-2026-25493
EUVD
EUVD-2026-6843
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
craftcms craft_cms 4.0.0
craftcms craft_cms 4.0.0
craftcms craft_cms 4.0.0
craftcms craft_cms 4.0.0
craftcms craft_cms 5.0.0
craftcms craft_cms 5.0.0
craftcms craft_cms From 4.0.0 (exc) to 4.16.18 (exc)
craftcms craft_cms From 5.0.0 (exc) to 5.8.22 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Craft platform versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It involves the saveAsset GraphQL mutation, which attempts to validate the initial URL hostname and resolved IP against a blocklist to prevent Server-Side Request Forgery (SSRF) attacks.

However, the HTTP client library Guzzle, used by Craft, follows HTTP redirects by default. An attacker can exploit this behavior by hosting a redirect that points to internal IP addresses or cloud metadata endpoints, effectively bypassing all SSRF protections.

This issue has been fixed in Craft versions 4.16.18 and 5.8.22.

Impact Analysis

This vulnerability can allow an attacker to bypass SSRF protections and make unauthorized requests to internal systems or cloud metadata services.

Such unauthorized access can lead to exposure of sensitive internal information, potential compromise of internal services, and unauthorized retrieval of cloud instance metadata, which may include credentials or configuration data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft to version 4.16.18 or later, or version 5.8.22 or later, where the issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart