GitHub Advisoryadvisory · Packagist

GHSA-pf9c-ch8r-2958 Statamic CMS: Server-Side Request Forgery via Glide

MEDIUM Published 2026-05-18 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45660
Ecosystem
Packagist
Packages
statamic/cms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-918
Reviewed
2026-05-18

Affected packages

• Packagist statamic/cms: < 5.73.22 → fixed in 5.73.22 • Packagist statamic/cms: >= 6.0.0-alpha.1, < 6.18.1 → fixed in 6.18.1

Description

Impact The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. Patches This has been fixed in 5.73.22 and 6.18.1

Related

Alias · CVE (1)

  • CVE-2026-45660 Statamic is a Laravel and Git powered content management system (CMS). vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References