p PatchFirst

CVE-2025-60868

CVE-2025-60868

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

CVSS 6.5 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • alt-design/alt-redirect Packagist

    Versions
    • v1.0.0
    • v1.0.1
    • v1.0.10
    • v1.0.2
    • v1.0.3
    • v1.0.4
    • v1.0.5
    • v1.0.6
    • v1.0.7
    • v1.0.8
    • v1.0.9
    • v1.1.0
    • v1.1.1
    • v1.1.2
    • v1.1.3
    • v1.1.4
    • v1.1.5
    • v1.1.6
    • v1.1.7
    • v1.1.8
    • v1.1.9
    • v1.2.0
    • v1.3.0
    • v1.3.1
    • v1.3.2
    • v1.3.3
    • v1.4.0
    • v1.5.0
    • v1.5.1
    • v1.5.2
    • v1.6.0
    • v1.6.1
    • v1.6.2
    • v1.6.3
    Affected ranges
    • ECOSYSTEM: < 1.6.4

    Update to 1.6.4

Original sources

Check your server →