CVE-2026-25492: Craft CMS Information Disclosure Flaw

CVE-2026-25492 Overview

CVE-2026-25492 is a Server-Side Request Forgery (SSRF) vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists in the save_images_Asset GraphQL mutation, which can be exploited to fetch internal URLs by providing a domain name that resolves to an internal IP address, effectively bypassing hostname validation controls. When combined with allowed non-image file extensions such as .txt, downstream image validation is also bypassed, enabling authenticated attackers with appropriate permissions to retrieve sensitive data including AWS instance metadata credentials from the underlying host infrastructure.

Critical Impact
Authenticated attackers can exploit this SSRF vulnerability to access internal network resources and potentially extract sensitive cloud metadata credentials, leading to further compromise of cloud infrastructure.

Affected Products

Craft CMS versions 3.5.0 through 4.16.17
Craft CMS versions 5.0.0-RC1 through 5.8.21

Discovery Timeline

2026-02-09 - CVE-2026-25492 published to NVD
2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25492

Vulnerability Analysis

This SSRF vulnerability (CWE-918) resides in the GraphQL asset handling functionality of Craft CMS. The save_images_Asset mutation accepts URL inputs for fetching remote images, but the hostname validation implementation contains a critical flaw. While the original code attempted to validate that hostnames were alphanumeric and not direct IP addresses, attackers could circumvent these protections by using domain names that resolve to internal IP addresses (DNS rebinding technique).

The attack is further compounded when Craft CMS configurations allow non-image file extensions like .txt. In such cases, the downstream image validation logic is bypassed entirely, permitting the retrieval of arbitrary content from internal endpoints. This is particularly dangerous in cloud environments where instance metadata services (such as AWS's 169.254.169.254) can be queried to obtain temporary security credentials, IAM role information, and other sensitive configuration data.

Root Cause

The root cause lies in insufficient hostname validation within the Asset.php GraphQL resolver. The original implementation only checked if the provided hostname was a direct IP address or contained invalid characters, but failed to account for DNS-based bypasses where legitimate-looking domain names resolve to internal or private IP addresses. The validation logic did not perform DNS resolution checks to verify the actual destination IP before making outbound requests.

Attack Vector

The attack requires network access and low-privilege authentication (specifically, permission to use the save_images_Asset GraphQL mutation). An attacker would craft a GraphQL mutation request providing a malicious URL with a domain under their control that resolves to an internal IP address. When processed, Craft CMS would resolve the domain, connect to the internal resource, and return the content to the attacker.

php

// Vulnerable code before patch (src/gql/resolvers/mutations/Asset.php)
         } elseif (!empty($fileInformation['url'])) {
             $url = $fileInformation['url'];
 
-            // make sure the hostname is alphanumeric and not an IP address
-            $hostname = parse_url($url, PHP_URL_HOST);
-            if (
-                !filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) ||
-                filter_var($hostname, FILTER_VALIDATE_IP)
-            ) {
+            if (!$this->validateHostname($url)) {
                 throw new UserError("$url contains an invalid hostname.");
             }

Source: GitHub Commit Reference

Detection Methods for CVE-2026-25492

Indicators of Compromise

Unusual GraphQL mutation requests targeting the save_images_Asset endpoint with URLs pointing to internal IP ranges or cloud metadata services
DNS queries from the CMS server resolving to internal IP addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254)
Log entries showing attempts to fetch non-image file types through the asset upload functionality

Detection Strategies

Monitor GraphQL request logs for save_images_Asset mutations containing suspicious URL patterns or repeated attempts with varying domains
Implement egress traffic analysis to detect connections from web servers to internal network segments or cloud metadata endpoints
Review application logs for UserError exceptions related to invalid hostname messages, which may indicate probing attempts

Monitoring Recommendations

Configure web application firewall (WAF) rules to inspect GraphQL payloads for SSRF indicators
Enable detailed logging for all GraphQL mutations involving URL inputs
Deploy network monitoring to alert on outbound connections from CMS servers to RFC 1918 addresses or link-local addresses

How to Mitigate CVE-2026-25492

Immediate Actions Required

Upgrade Craft CMS to version 4.16.18 or 5.8.22 immediately to apply the security patch
Audit user permissions to ensure only trusted accounts have access to the save_images_Asset GraphQL mutation
Review allowed file extensions in asset configurations and restrict to actual image types only

Patch Information

Craft CMS has released security patches addressing this vulnerability. The fix introduces a new validateHostname() method that performs comprehensive validation including DNS resolution checks to prevent SSRF attacks via DNS rebinding.

Craft CMS 4.x: Upgrade to version 4.16.18 or later
Craft CMS 5.x: Upgrade to version 5.8.22 or later

For detailed patch information, refer to the GitHub Security Advisory GHSA-96pq-hxpw-rgh8 and the release notes for version 5.8.22.

Workarounds

Disable GraphQL API access entirely if not required for your deployment
Restrict the save_images_Asset mutation to only highly trusted administrative users via Craft's permission system
Implement network-level controls to block outbound connections from the CMS server to internal networks and cloud metadata services

bash

# Example iptables rule to block access to AWS metadata service
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block common internal network ranges from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP