CVE-2026-54242: Statamic CMS SSRF Vulnerability

CVE-2026-54242 Overview

CVE-2026-54242 is a Server-Side Request Forgery (SSRF) vulnerability in Statamic, a Laravel and Git powered content management system (CMS). The flaw affects the Glide image proxy's URL validation logic in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php. Attackers who control a hostname's DNS can bypass validation using DNS rebinding, causing the server to issue HTTP requests to internal addresses. This includes loopback interfaces, private network ranges, and cloud metadata endpoints such as those used by AWS, Azure, and GCP. The issue affects Statamic sites that forward user-supplied URLs to Glide, and is fixed in versions 5.73.24 and 6.20.1.

Critical Impact
Attackers can coerce the Statamic server into fetching internal resources, potentially exposing cloud instance metadata credentials and internal service data.

Affected Products

Statamic CMS versions prior to 5.73.24 (5.x branch)
Statamic CMS versions prior to 6.20.1 (6.x branch)
Sites passing user-supplied URLs to the Glide image proxy

Discovery Timeline

2026-07-17 - CVE-2026-54242 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54242

Vulnerability Analysis

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition classified as [CWE-367]. Statamic's Glide integration accepts remote image URLs and validates that the hostname resolves to a publicly routable IP address. However, the validation and the subsequent HTTP fetch each perform independent DNS lookups. An attacker who controls the authoritative DNS server for the submitted hostname can return a public IP during validation and a private IP during the fetch. This allows the attacker to redirect the server-side HTTP request toward internal-only endpoints. Reachable targets include 127.0.0.1, RFC1918 ranges, and cloud metadata services at 169.254.169.254.

Root Cause

The root cause lies in the separation between URL validation and URL retrieval. RemoteUrlValidator.php verified hostname resolution but did not pin the resolved IP address to the outbound request. GuzzleAdapter.php then re-resolved the hostname when performing the HTTP GET, opening a rebinding window.

Attack Vector

Exploitation requires the attacker to control DNS for an attacker-owned domain and to have permission to submit URLs to the Glide image proxy endpoint. The attacker configures short TTL DNS records that alternate between a public IP (to satisfy validation) and an internal target (served to the fetch call).

php

// Security patch in src/Imaging/RemoteUrlValidator.php
// Source: https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da
public function parse($url)
{
    $components = $this->validatedComponents($url);

    return [
        'path' => Str::after($components['path'], '/'),
        'base' => $components['scheme'].'://'.$components['host'].$components['port_suffix'],
        'query' => $components['query'],
    ];
}

public function validate($url)
{
    $this->parse($url);
}

/**
 * Resolve and validate the URL host, returning the host, port, and the
 * validated public IPs it resolves to. These IPs are intended to be pinned
 * to the actual connection so the host cannot be rebound to an internal
 * address between this check and the request being made.
 */
public function resolve($url)
{
    $components = $this->validatedComponents($url);

    return [
        'host' => $components['host'],

The fix returns the validated IP set so callers can pin the connection, eliminating the rebinding window.

Detection Methods for CVE-2026-54242

Indicators of Compromise

Outbound HTTP requests from the Statamic web server to 169.254.169.254, 127.0.0.0/8, or RFC1918 address ranges originating from the Glide image handler.
DNS queries from the web server resolving external hostnames to internal IP addresses with unusually short TTLs.
Glide request logs containing image URLs pointing to attacker-controlled domains with abnormal resolution patterns.

Detection Strategies

Inspect web server access logs for repeated Glide endpoint requests referencing the same external hostname within short time windows.
Correlate DNS resolver logs with outbound firewall logs to identify hostnames that resolve to both public and private IPs.
Deploy egress filtering rules that alert on any Statamic-originated traffic to cloud metadata IPs.

Monitoring Recommendations

Enable audit logging on the Glide image proxy and forward events to a centralized SIEM for correlation.
Monitor for HTTP 200 responses from internal services to the Statamic host process.
Track DNS TTL anomalies from resolvers used by the application tier.

How to Mitigate CVE-2026-54242

Immediate Actions Required

Upgrade Statamic to version 5.73.24 or 6.20.1 immediately.
Restrict outbound network access from the Statamic web server to only required destinations.
Block access to cloud metadata endpoints (169.254.169.254) at the host or network firewall level.
Audit recent Glide request logs for suspicious external hostnames.

Patch Information

Statamic addressed the issue in GitHub Release v5.73.24 and GitHub Release v6.20.1. The patch is described in GitHub Pull Request #14761 and detailed in the GitHub Security Advisory GHSA-v5c4-wcpj-x73m. The fix pins the validated public IP to the outbound Guzzle HTTP connection, preventing DNS re-resolution between check and use.

Workarounds

Disable user-supplied URL input to the Glide image proxy until patches are applied.
Use IMDSv2 on AWS instances to require session tokens, mitigating metadata theft via SSRF.
Route Statamic outbound traffic through an egress proxy that enforces IP allowlists.
Configure network policies to block private IP responses for DNS queries made by the web tier.

bash

# Upgrade Statamic via Composer
composer require statamic/cms:^5.73.24 --update-with-dependencies
# Or for the 6.x branch
composer require statamic/cms:^6.20.1 --update-with-dependencies

# Verify installed version
php artisan statamic:version

# Block cloud metadata endpoint at host firewall (Linux iptables)
iptables -A OUTPUT -d 169.254.169.254 -j DROP