CVE-2026-25492: Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
- The save_images_Asset graphql mutation allows a user to give a url of an image to download. (Url must use a domain, not a raw IP.)
- Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 (special AWS metadata IP)
- Attacker invokes save_images_Asset with url: http://attacker.domain/latest/meta-data/iam/security-credentials and filename “foo.txt”
- Craft fetches sensitive information on attacker’s behalf, and makes it available for download at /assets/images/foo.txt
- Normal checks to verify that image is valid are bypassed because of .txt extension
- Normal checks to verify that url is not an IP address are bypassed because user provided a valid domain that resolves to a sensitive internal IP address
References
- github.com/advisories/GHSA-96pq-hxpw-rgh8
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/e838a221df2ab15cd54248f22fc8355d47df29ff
- github.com/craftcms/cms/releases/tag/4.16.18
- github.com/craftcms/cms/releases/tag/5.8.22
- github.com/craftcms/cms/security/advisories/GHSA-96pq-hxpw-rgh8
- nvd.nist.gov/vuln/detail/CVE-2026-25492
Code Behaviors & Features
Detect and mitigate CVE-2026-25492 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →