CVEvulnerability

CVE-2025-60868

6.5 MEDIUM Published 2025-10-10 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-10-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-290

Description

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References