EUVD-2026-33365
GHSA-pf9c-ch8r-2958
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses - including loopback, private network, and cloud metadata endpoints.
This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected.
Patches
This has been fixed in 5.73.22 and 6.18.1
AnalysisAI
Server-Side Request Forgery in Statamic CMS's Glide image proxy allows unauthenticated remote attackers to bypass IP validation and force the server to issue HTTP requests to internal infrastructure, including loopback addresses, RFC-1918 private networks, and cloud metadata endpoints such as AWS IMDSv1 (169.254.169.254). The bypass exploits unnormalized alternative IP representations (e.g., octal, hexadecimal, decimal-encoded) that evade the public-IP allowlist check before PHP normalizes them. Only deployments running PHP below 8.3 and passing user-supplied URLs to Glide are exposed; vendor-released patches exist in versions 5.73.22 and 6.18.1. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-918 (Server-Side Request Forgery): Statamic CMS embeds the Glide image proxy (composer/statamic/cms) which accepts user-controlled URL parameters for dynamic image manipulation. The public-IP blocklist check operates on the raw user-supplied string before IP normalization, allowing alternative representations of restricted addresses - such as 0x7f000001 for 127.0.0.1 or 0251.0.0.1 in octal - to pass validation undetected. PHP 8.3 introduced stricter built-in IP parsing that normalizes these representations before they reach application logic, which is why PHP 8.3+ runtimes are inherently immune. Affected CPEs are pkg:composer/statamic_cms on the 5.x branch (< 5.73.22) and the 6.x branch (>= 6.0.0-alpha.1, < 6.18.1). The CVSS Changed Scope (S:C) correctly reflects that the exploited component (the CMS web process) can reach and expose resources in adjacent internal systems beyond the web application boundary.
RemediationAI
Upgrade Statamic CMS to version 5.73.22 on the 5.x branch or to version 6.18.1 on the 6.x branch, as confirmed by the vendor advisory at https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958. As an independent compensating control, upgrading the PHP runtime to 8.3 or newer also neutralizes the bypass because PHP 8.3 natively normalizes IP representations, closing the validation gap without requiring a Statamic code change - note however that relying solely on PHP version without patching Statamic is inadvisable as it leaves the underlying logic flaw unaddressed. For deployments where Glide user-supplied URL ingestion is not functionally required, disable or restrict that feature at the application or WAF layer to eliminate the attack surface entirely. For AWS-hosted instances, enforce IMDSv2 (token-required metadata service mode) to prevent credential theft via SSRF even if exploitation occurs; this is a high-value, low-disruption control with no application-side trade-offs. Block outbound HTTP from the web process to RFC-1918 ranges and 169.254.0.0/16 at the network or egress firewall layer as a defense-in-depth measure.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today