PT-2026-7142 · Craft Cms · Craft Cms

Leftenantzero · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25492

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.5.0 through 4.16.17 Craft CMS versions 5.0.0-RC1 through 5.8.21

Description The save images Asset GraphQL mutation in Craft CMS can be exploited to fetch internal URLs. This is possible by providing a domain name that resolves to an internal IP address, which bypasses hostname validation. If non-image file extensions, such as .txt, are permitted, downstream image validation is bypassed. This allows an authenticated attacker with appropriate permissions to use the save images Asset mutation to retrieve sensitive data, such as AWS instance metadata credentials, from the underlying host. The vulnerable mutation is accessed via the GraphQL API endpoint /graphql. The domain parameter is used to provide the domain name that resolves to an internal IP address.

Recommendations Update to Craft CMS version 4.16.18 or later. Update to Craft CMS version 5.8.22 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-25492

GHSA-96PQ-HXPW-RGH8

Affected Products

Craft Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25492.json · Exploit
• https://github.com/craftcms/cms/commit/e838a221df2ab15cd54248f22fc8355d47df29ff · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-96pq-hxpw-rgh8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-96pq-hxpw-rgh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25492 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://twitter.com/CVEnew/status/2020959692957114769 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2020986465555972506 · Twitter Post