AIKIDO-2026-801685

TL;DR

The downloadFile() helper in AssetHelper.php fetches a Feed Me asset source value and passes the bytes to Craft's asset storage without checking that the value stays inside the web root or points to a safe public host. A user who can configure or trigger an asset import can set the source to a local filesystem path outside the upload volume or to an internal URL such as a loopback or private network address, so the plugin reads that resource and stores it as a Craft asset, leading to arbitrary local file read and server-side request forgery against internal services. The fix validates remote hosts against reserved and private IP ranges, pins the resolved address with CURLOPT_RESOLVE to prevent DNS rebinding, and blocks dotfiles and restricted directories in local paths.