CVE-2026-25494: Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
The saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.
References
- github.com/advisories/GHSA-m5r2-8p9x-hp5m
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/d49e93e5ba0c48939ce5eaa6cd9b4a990542d8b2
- github.com/craftcms/cms/releases/tag/4.16.18
- github.com/craftcms/cms/releases/tag/5.8.22
- github.com/craftcms/cms/security/advisories/GHSA-m5r2-8p9x-hp5m
- nvd.nist.gov/vuln/detail/CVE-2026-25494
Code Behaviors & Features
Detect and mitigate CVE-2026-25494 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →