GitHub Advisoryadvisory · Packagist

GHSA-rpjr-pcmr-9ppw Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

MEDIUM Published 2025-10-10 Modified 2025-10-14 Official page ↗
Aliases
CVE-2025-60868
Ecosystem
Packagist
Packages
alt-design/alt-redirect
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-290
Reviewed
2025-10-13

Affected packages

• Packagist alt-design/alt-redirect: < 1.6.4 → fixed in 1.6.4

Description

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

Related

Alias · CVE (1)

  • CVE-2025-60868 The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is… vulnerability

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References