CVE-2026-25492

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25492
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25492.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25492
Aliases
Published
2026-02-09T19:33:24Z
Modified
2026-08-12T03:51:21Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Details

Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25492.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
c6671af5af9e45f57ca9ab50d4b30b07282819d3
Fixed
fc466946af3dd7928f5fd0e26099b9dc0eb2ce72
Introduced
f6a8fb685d44e387435825e3a96809eeda4973a6
Fixed
8e23a7a14d50f169c10a487348c993384d479e06
Fixed
e838a221df2ab15cd54248f22fc8355d47df29ff
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "4.16.18"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.8.22"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25492.json"