CVE-2026-25494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25494
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25494.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25494
Aliases
Downstream
Published
2026-02-09T19:41:13Z
Modified
2026-08-12T03:51:32Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation
Details

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25494.json"
}
References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/cms
Events
Introduced
04755d93f86d07cc183db47db8a0eee106892e30
Fixed
8e23a7a14d50f169c10a487348c993384d479e06
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0-RC1"
        },
        {
            "fixed": "5.8.22"
        }
    ],
    "source": "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/nystudio107/craft-seomatic
Events
Introduced
a31f7d211b52d55d274c66a291310ceec64c733f
Last Affected
a31f7d211b52d55d274c66a291310ceec64c733f
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.0-NA"
        },
        {
            "last_affected": "4.0.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*
4.0.0
4.0.0-NA
4.0.0-rc1
4.0.0-rc2
4.0.0-rc3
5.*
5.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25494.json"