AIKIDO-2026-954774
statamic/cms is vulnerable to Server-Side Request Forgery (SSRF)
35
Low Risk
This Affects:
statamic/cmsTL;DR
Glide's remote image proxy validates request URLs but does not reject IPv6 addresses that embed an IPv4 address, such as NAT64 addresses. On a server whose network translates these addresses to IPv4, a user supplied URL passed to Glide can cause the server to make HTTP requests to internal network addresses. This affects sites that pass user supplied URLs to Glide. The fix rejects these embedded address forms during remote URL validation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass user supplied URLs to Glide.
Background info
statamic/cms is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 5.74.4 and 6.0.0 - 6.35.0.
How to fix this
Upgrade the statamic/cms library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.