Vulnerability-Lookup

CVE-2026-45660 (GCVE-0-2026-45660)

Vulnerability from cvelistv5 – Published: 2026-05-29 16:43 – Updated: 2026-05-29 19:36

Title

Statamic: Server-Side Request Forgery via Glide

Summary

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/statamic/cms/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
statamic	cms	Affected: < 5.73.22 Affected: >= 6.0.0-alpha.1, < 6.18.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45660",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T19:36:25.485634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T19:36:42.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cms",
          "vendor": "statamic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.73.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha.1, \u003c 6.18.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy\u0027s URL validation could be bypassed using an IP representation that wasn\u0027t normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses \u2014 including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T16:43:34.231Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958"
        }
      ],
      "source": {
        "advisory": "GHSA-pf9c-ch8r-2958",
        "discovery": "UNKNOWN"
      },
      "title": "Statamic: Server-Side Request Forgery via Glide"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45660",
    "datePublished": "2026-05-29T16:43:34.231Z",
    "dateReserved": "2026-05-12T21:59:25.665Z",
    "dateUpdated": "2026-05-29T19:36:42.883Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45660",
      "date": "2026-07-23",
      "epss": "0.00151",
      "percentile": "0.04757"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45660\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-29T18:17:11.640\",\"lastModified\":\"2026-07-22T06:10:00.170\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy\u0027s URL validation could be bypassed using an IP representation that wasn\u0027t normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses \u2014 including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.\"},{\"lang\":\"es\",\"value\":\"Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.22 y 6.18.1, la validaci\u00f3n de URL del proxy de im\u00e1genes Glide podr\u00eda ser eludida utilizando una representaci\u00f3n de IP que no estaba normalizada antes de la verificaci\u00f3n de IP p\u00fablica. Un usuario no autenticado podr\u00eda hacer que el servidor realizara solicitudes HTTP a direcciones internas - incluyendo bucle invertido, red privada y puntos finales de metadatos en la nube. Esto afecta a los sitios que pasan URL proporcionadas por el usuario a Glide. Los sitios que ejecutan PHP 8.3 o superior no se ven afectados. Esta vulnerabilidad est\u00e1 corregida en las versiones 5.73.22 y 6.18.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"statamic\",\"product\":\"cms\",\"versions\":[{\"version\":\"\u003c 5.73.22\",\"status\":\"affected\"},{\"version\":\"\u003e= 6.0.0-alpha.1, \u003c 6.18.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-29T19:36:25.485634Z\",\"id\":\"CVE-2026-45660\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:33:17+00:00",
      "cve": "CVE-2026-45660",
      "id": "CVE-2026-45660",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Statamic: Server-Side Request Forgery via Glide",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45660.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45660\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-29T19:36:25.485634Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-29T19:36:36.536Z\"}}], \"cna\": {\"title\": \"Statamic: Server-Side Request Forgery via Glide\", \"source\": {\"advisory\": \"GHSA-pf9c-ch8r-2958\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"statamic\", \"product\": \"cms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 5.73.22\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0-alpha.1, \u003c 6.18.1\"}]}], \"references\": [{\"url\": \"https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958\", \"name\": \"https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy\u0027s URL validation could be bypassed using an IP representation that wasn\u0027t normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses \\u2014 including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-918\", \"description\": \"CWE-918: Server-Side Request Forgery (SSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-29T16:43:34.231Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45660\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-29T19:36:42.883Z\", \"dateReserved\": \"2026-05-12T21:59:25.665Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-29T16:43:34.231Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45660

Vulnerability from fkie_nvd - Published: 2026-05-29 18:17 - Updated: 2026-07-22 06:10

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cms",
          "vendor": "statamic",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.73.22"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha.1, \u003c 6.18.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy\u0027s URL validation could be bypassed using an IP representation that wasn\u0027t normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses \u2014 including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1."
    },
    {
      "lang": "es",
      "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.22 y 6.18.1, la validaci\u00f3n de URL del proxy de im\u00e1genes Glide podr\u00eda ser eludida utilizando una representaci\u00f3n de IP que no estaba normalizada antes de la verificaci\u00f3n de IP p\u00fablica. Un usuario no autenticado podr\u00eda hacer que el servidor realizara solicitudes HTTP a direcciones internas - incluyendo bucle invertido, red privada y puntos finales de metadatos en la nube. Esto afecta a los sitios que pasan URL proporcionadas por el usuario a Glide. Los sitios que ejecutan PHP 8.3 o superior no se ven afectados. Esta vulnerabilidad est\u00e1 corregida en las versiones 5.73.22 y 6.18.1."
    }
  ],
  "id": "CVE-2026-45660",
  "lastModified": "2026-07-22T06:10:00.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45660",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-29T19:36:25.485634Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-29T18:17:11.640",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-PF9C-CH8R-2958

Vulnerability from github – Published: 2026-05-18 15:32 – Updated: 2026-06-09 10:30

Summary

Statamic CMS: Server-Side Request Forgery via Glide

Details

Impact

The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints.

This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected.

Patches

This has been fixed in 5.73.22 and 6.18.1

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.73.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0-alpha.1"
            },
            {
              "fixed": "6.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T15:32:43Z",
    "nvd_published_at": "2026-05-29T18:17:11Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Glide image proxy\u0027s URL validation could be bypassed using an IP representation that wasn\u0027t normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses \u2014 including loopback, private network, and cloud metadata endpoints.\n\nThis affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected.\n\n### Patches\n\nThis has been fixed in 5.73.22 and 6.18.1",
  "id": "GHSA-pf9c-ch8r-2958",
  "modified": "2026-06-09T10:30:43Z",
  "published": "2026-05-18T15:32:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45660"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/statamic/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Statamic CMS: Server-Side Request Forgery via Glide"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-45660 (GCVE-0-2026-45660)

FKIE_CVE-2026-45660

GHSA-PF9C-CH8R-2958

Impact

Patches

Tags

Sightings

Nomenclature