CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
Authenticated attackers can exploit a GraphQL mutation to bypass validation and exfiltrate sensitive AWS credentials from the underlying host via SSRF.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25492?
CVE-2026-25492 is a medium-severity server-side request forgery vulnerability in Craftcms Craft Cms, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, bypassing hostname validation. When a non-image file extension such as .txt is allowed, downstream image validation is bypassed, which can allow an authenticated attacker with permission to use save_images_Asset to retrieve sensitive data such as AWS instance metadata credentials from the underlying host. This issue is patched in versions 4.16.18 and 5.8.22.
Weakness: CWE-918
Which versions are affected by CVE-2026-25492?
4 open source packages ship an affected version, including craftcms/craft. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/craft Packagist | From 3.5.0 | 4.16.18 |
craftcms/craft Packagist | From 3.5.0 | 4.16.18 |
craftcms/craft Packagist | From 5.0.0-RC1 | 5.8.22 |
craftcms/craft Packagist | From 5.0.0-RC1 | 5.8.22 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-25492?
Upgrade craftcms/craft to a fixed version for your release line: 4.16.18 or 5.8.22.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-25492 being exploited?
There is no known exploitation of CVE-2026-25492 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-96pq-hxpw-rgh8.