CVE-2026-25492: Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
- The save_images_Asset graphql mutation allows a user to give a url of an image to download. (Url must use a domain, not a raw IP.)
- Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 (special AWS metadata IP)
- Attacker invokes save_images_Asset with url: http://attacker.domain/latest/meta-data/iam/security-credentials and filename “foo.txt”
- Craft fetches sensitive information on attacker’s behalf, and makes it available for download at /assets/images/foo.txt
- Normal checks to verify that image is valid are bypassed because of .txt extension
- Normal checks to verify that url is not an IP address are bypassed because user provided a valid domain that resolves to a sensitive internal IP address
References
- github.com/advisories/GHSA-96pq-hxpw-rgh8
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/e838a221df2ab15cd54248f22fc8355d47df29ff
- github.com/craftcms/cms/releases/tag/4.16.18
- github.com/craftcms/cms/releases/tag/5.8.22
- github.com/craftcms/cms/security/advisories/GHSA-96pq-hxpw-rgh8
- nvd.nist.gov/vuln/detail/CVE-2026-25492
Code Behaviors & Features
Detect and mitigate CVE-2026-25492 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →