PT-2026-53027 · Packagist · Statamic Cms

Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-54242

OSV

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Impact

The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation. This could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints.

This affects sites that pass user-supplied URLs to Glide.

Patches

This has been fixed in 5.73.24 and 6.20.1.

Correção

Time Of Check To Time Of Use

SSRF

Enumeração de Fraquezas

CWE-367

CWE-918

Identificadores relacionados

CVE-2026-54242

GHSA-V5C4-WCPJ-X73M

Produtos afetados

Statamic Cms

Referências · 3

• https://github.com/statamic/cms · Nota
• https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m · Nota
• https://osv.dev/vulnerability/GHSA-v5c4-wcpj-x73m · Aviso do Fabricante