CVE-2026-25494: Craft CMS Auth Bypass Vulnerability

CVE-2026-25494 Overview

CVE-2026-25494 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS, a popular platform for creating digital experiences. The vulnerability exists in the saveAsset GraphQL mutation, which uses PHP's filter_var(..., FILTER_VALIDATE_IP) function to block access to specific IP addresses. However, this validation method fails to recognize alternative IP notations such as hexadecimal or mixed formats, allowing attackers to bypass the blocklist and potentially access sensitive cloud metadata services.

Critical Impact

Attackers can bypass IP blocklist restrictions to access cloud metadata services, potentially exposing sensitive infrastructure credentials and configuration data.

Affected Products

• Craft CMS versions 4.0.0-RC1 through 4.16.17
• Craft CMS versions 5.0.0-RC1 through 5.8.21

Discovery Timeline

• 2026-02-09 - CVE CVE-2026-25494 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25494

Vulnerability Analysis

This vulnerability stems from insufficient input validation in the saveAsset GraphQL mutation within Craft CMS. The application relies on PHP's native filter_var() function with the FILTER_VALIDATE_IP filter to implement an IP address blocklist. While this approach correctly identifies standard decimal notation IP addresses (e.g., 169.254.169.254), it fails to detect equivalent representations using alternative IP notations.

Attackers can leverage hexadecimal (e.g., 0xa9.0xfe.0xa9.0xfe), octal (e.g., 0251.0376.0251.0376), or mixed notation formats to represent blocked IP addresses. Since FILTER_VALIDATE_IP does not normalize these alternative formats, the blocklist check passes, allowing the request to proceed to the actual network layer where these notations are correctly resolved to their intended IP addresses.

This bypass is particularly dangerous in cloud environments where metadata services (AWS, GCP, Azure) expose sensitive information at well-known IP addresses like 169.254.169.254. Successful exploitation could allow attackers to retrieve instance credentials, environment variables, and other sensitive configuration data.

Root Cause

The root cause is the reliance on filter_var(..., FILTER_VALIDATE_IP) for security-critical IP address validation. This PHP function performs syntactic validation of IP addresses but does not canonicalize or normalize alternative IP representations before comparison. The function was designed for format validation rather than security filtering, making it unsuitable for implementing blocklists that must account for IP address obfuscation techniques. CWE-918 (Server-Side Request Forgery) accurately categorizes this vulnerability type.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can craft a malicious GraphQL mutation targeting the saveAsset endpoint with a URL containing an obfuscated IP address representation. The flow is as follows:

1. Attacker sends a GraphQL mutation to the saveAsset endpoint
2. The mutation includes a URL with an IP address in hexadecimal or mixed notation
3. The filter_var() blocklist check fails to recognize the obfuscated IP
4. The request is forwarded to the specified target, bypassing the intended restriction
5. The attacker receives the response, potentially containing sensitive metadata

 use GraphQL\Error\UserError;
 use GraphQL\Type\Definition\ResolveInfo;
 use GuzzleHttp\Client;
+use Illuminate\Support\Collection;
 use Throwable;
 use yii\base\Exception;
 use yii\base\InvalidArgumentException;

Source: GitHub Commit Details

The patch introduces additional IP address normalization by converting hexadecimal hostname segments to their decimal equivalents before validation, ensuring that obfuscated IP addresses are properly detected and blocked.

Detection Methods for CVE-2026-25494

Indicators of Compromise

• Unusual GraphQL requests to the saveAsset mutation containing hexadecimal, octal, or mixed IP notations in URL parameters
• Outbound connections from the Craft CMS server to cloud metadata service IP addresses (169.254.169.254)
• Access logs showing requests with encoded or obfuscated IP address formats in asset URLs
• Unexpected responses or data exfiltration patterns following GraphQL mutation requests

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing alternative IP notations (hexadecimal, octal, mixed formats) in URL parameters
• Monitor GraphQL endpoint access logs for anomalous saveAsset mutation patterns
• Deploy network monitoring to alert on outbound connections to cloud metadata service IP ranges
• Configure SIEM rules to correlate GraphQL mutation activity with subsequent internal network requests

Monitoring Recommendations

• Enable detailed logging for all GraphQL mutations, particularly saveAsset operations
• Monitor egress traffic from web application servers for connections to internal IP ranges and cloud metadata endpoints
• Implement alerting for any successful requests that resolve to blocked IP address ranges
• Review application logs regularly for patterns indicative of SSRF exploitation attempts

How to Mitigate CVE-2026-25494

Immediate Actions Required

• Upgrade Craft CMS to version 4.16.18 or 5.8.22 immediately to address this vulnerability
• Audit GraphQL endpoint access controls and ensure proper authentication is enforced
• Review recent logs for evidence of exploitation attempts using alternative IP notations
• Implement network-level controls to restrict outbound access from web servers to cloud metadata services

Patch Information

Craft CMS has released patched versions that address this vulnerability. Users should upgrade to version 4.16.18 for the 4.x branch or version 5.8.22 for the 5.x branch. The fix introduces proper IP address normalization that converts alternative notations to their decimal equivalents before blocklist validation. For detailed patch information, see the GitHub Security Advisory GHSA-m5r2-8p9x-hp5m and the GitHub Release Version 5.8.22.

Workarounds

• Implement network-level egress filtering to block all outbound requests to cloud metadata service IP addresses (169.254.169.254)
• Deploy a reverse proxy or WAF that normalizes IP addresses before forwarding requests to the application
• Disable the GraphQL API entirely if it is not required for application functionality
• Restrict GraphQL endpoint access to authenticated and authorized users only

# Example iptables rule to block outbound access to cloud metadata services
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example nginx configuration to block suspicious IP patterns in requests
location /api {
    if ($request_uri ~* "0x[a-fA-F0-9]+") {
        return 403;
    }
}