CVE-2026-45660
Statamic: Server-Side Request Forgery via Glide
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Statamic: Server-Side Request Forgery via Glide
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
- Record
CVE-2026-45660- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-33365
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
- Record
EUVD-2026-33365- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pf9c-ch8r-2958
Statamic CMS: Server-Side Request Forgery via Glide
Impact
The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints.
This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected.
Patches
This has been fixed in 5.73.22 and 6.18.1
- Record
GHSA-pf9c-ch8r-2958- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
- Record
CVE-2026-45660- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Statamic: Server-Side Request Forgery via Glide
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
- Record
CVE-2026-45660- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-pf9c-ch8r-2958
Statamic CMS: Server-Side Request Forgery via Glide
Impact
The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints.
This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected.
Patches
This has been fixed in 5.73.22 and 6.18.1
- Record
GHSA-pf9c-ch8r-2958- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
statamic/cmsPackagist |
before 5.73.22 | 5.73.22 |
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.18.1 | 6.18.1 |
statamic/cmsPackagist |
before 5.73.22, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.10v3.0.0-beta.11v3.0.0-beta.12 Show 45 moreShow lessv3.0.0-beta.13v3.0.0-beta.14v3.0.0-beta.15v3.0.0-beta.16v3.0.0-beta.17v3.0.0-beta.18v3.0.0-beta.19v3.0.0-beta.2v3.0.0-beta.20v3.0.0-beta.21v3.0.0-beta.22v3.0.0-beta.23v3.0.0-beta.24v3.0.0-beta.25v3.0.0-beta.26v3.0.0-beta.27v3.0.0-beta.28v3.0.0-beta.29v3.0.0-beta.3v3.0.0-beta.30v3.0.0-beta.31v3.0.0-beta.32v3.0.0-beta.33v3.0.0-beta.34v3.0.0-beta.35v3.0.0-beta.36v3.0.0-beta.37v3.0.0-beta.38v3.0.0-beta.39v3.0.0-beta.4v3.0.0-beta.40v3.0.0-beta.41v3.0.0-beta.42v3.0.0-beta.43v3.0.0-beta.44v3.0.0-beta.45v3.0.0-beta.46v3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.0.0-beta.9v3.0.1v3.0.10v3.0.11 |
5.73.22 |
statamic/cmsPackagist |
6.0.0-alpha.1 up to 6.18.1, plus listed versions v6.0.0v6.0.0-alpha.1v6.0.0-alpha.10v6.0.0-alpha.11v6.0.0-alpha.12 Show 45 moreShow lessv6.0.0-alpha.13v6.0.0-alpha.14v6.0.0-alpha.15v6.0.0-alpha.16v6.0.0-alpha.17v6.0.0-alpha.18v6.0.0-alpha.19v6.0.0-alpha.2v6.0.0-alpha.20v6.0.0-alpha.21v6.0.0-alpha.3v6.0.0-alpha.4v6.0.0-alpha.5v6.0.0-alpha.6v6.0.0-alpha.7v6.0.0-alpha.8v6.0.0-alpha.9v6.0.0-beta.1v6.0.0-beta.2v6.0.0-beta.3v6.0.0-beta.4v6.0.0-beta.5v6.0.0-beta.6v6.1.0v6.10.0v6.11.0v6.12.0v6.13.0v6.14.0v6.15.0v6.16.0v6.17.0v6.18.0v6.2.0v6.2.1v6.2.2v6.2.3v6.2.4v6.2.5v6.3.0v6.3.1v6.3.2v6.3.3v6.4.0v6.4.1 |
6.18.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45660 is a medium vulnerability (CVSS 5.4) in Statamic Cms, published May 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in statamic/cms 5.73.22.
References
Left out here: 455 versions. The JSON record has them.