PT-2026-7143 · Craft · Craft

Mhe4Am · Published 2026-02-09 · Updated 2026-02-11 · CVE-2026-25493

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Craft versions 4.0.0-RC1 through 4.16.17 Craft versions 5.0.0-RC1 through 5.8.21

Description The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. This allows an attacker to bypass Server-Side Request Forgery (SSRF) protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. The application validates the initial URL, but Guzzle's redirect behavior circumvents this validation. The mutation uses the /saveAsset GraphQL endpoint with the url parameter. The url parameter is used to specify the location of the asset to be saved.

Recommendations Craft versions prior to 4.16.18 are affected. Craft versions prior to 5.8.22 are affected. Disable redirects.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-25493

GHSA-8JR8-7HR4-VHFX

Affected Products

Craft

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25493.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-8jr8-7hr4-vhfx · Patch
• https://github.com/craftcms/cms/commit/0974055634af68998f67850ab2045d8aaa19fa98 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25493 · Security Note
• https://osv.dev/vulnerability/GHSA-8jr8-7hr4-vhfx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25493 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://twitter.com/CVEnew/status/2020959691992399968 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2020983905780666380 · Twitter Post