PT-2026-7144 · Craft · Craft

Mhe4Am · Published 2026-02-09 · Updated 2026-02-11 · CVE-2026-25494

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft versions 4.0.0-RC1 through 4.16.17 Craft versions 5.0.0-RC1 through 5.8.21

Description The saveAsset GraphQL mutation in Craft does not properly validate IP addresses used to access cloud metadata services. The application uses filter var(..., FILTER VALIDATE IP) to block a list of IP addresses, but this function does not recognize alternative IP notations like hexadecimal or mixed formats. This allows attackers to bypass the blocklist and potentially access cloud metadata. The vulnerable component is the saveAsset mutation. The vulnerable parameter is the IP address used in the request.

Recommendations Update to Craft version 4.16.18 or later. Update to Craft version 5.8.22 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-25494

GHSA-M5R2-8P9X-HP5M

Affected Products

Craft

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25494.json · Exploit
• https://github.com/craftcms/cms/commit/d49e93e5ba0c48939ce5eaa6cd9b4a990542d8b2 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-m5r2-8p9x-hp5m · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25494 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25494 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m5r2-8p9x-hp5m · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://twitter.com/VulmonFeeds/status/2020981345745359256 · Twitter Post
• https://twitter.com/_cvereports/status/2021013768663175546 · Twitter Post
• https://twitter.com/CVEnew/status/2020959691078025602 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post