p PatchFirst

CVE-2026-25492

CVE-2026-25492 · Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.

CVSS 5.3 · Media · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • cms

    Versiones
    • >= 5.0.0-RC1, < 5.8.22: Afectada
    • >= 3.5.0, < 4.16.18: Afectada

    Sin corrección publicada

  • craftcms/craft Packagist

    Versiones
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.3.2
    • 5.4.0
    • 5.4.1
    • 5.5.0
    • 5.5.1
    • 5.6.0
    • 5.7.0
    • 5.8.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 5.0.0-RC1, < 5.8.22

    Actualiza a 5.8.22

  • craftcms/craft Packagist

    Versiones
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.3.1
    • 4.4.0
    • 4.5.0
    • 4.6.0
    • 4.7.0
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 3.5.0, < 4.16.18

    Actualiza a 4.16.18

Fuentes originales

Comprueba tu servidor →