CVE-2026-25493 Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
Attackers can bypass SSRF protections in Craft CMS GraphQL mutations via HTTP redirects to access internal resources or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25493?
CVE-2026-25493 is a medium-severity server-side request forgery vulnerability in Craftcms Craft Cms, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. This issue is patched in versions 4.16.18 and 5.8.22.
Weakness: CWE-918
Which versions are affected by CVE-2026-25493?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.16.18 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.16.18 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.22 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.22 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-25493?
Upgrade craftcms/cms to a fixed version for your release line: 4.16.18 or 5.8.22.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-25493 being exploited?
There is no known exploitation of CVE-2026-25493 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-8jr8-7hr4-vhfx.