EUVD-2026-45320
GHSA-v5c4-wcpj-x73m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-exploitable; AC:H for DNS rebinding timing requirement; PR:L for required authenticated session; S:C for impact on internal services beyond Statamic; C:L/I:L conservative given variable internal target sensitivity.
Primary rating from Vendor (https://github.com/statamic/cms).
CVSS VectorVendor: https://github.com/statamic/cms
Lifecycle Timeline
2DescriptionCVE.org
Impact
The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation. This could cause the server to make HTTP requests to internal addresses - including loopback, private network, and cloud metadata endpoints.
This affects sites that pass user-supplied URLs to Glide.
Patches
This has been fixed in 5.73.24 and 6.20.1.
AnalysisAI
Server-Side Request Forgery (SSRF) in Statamic CMS allows authenticated low-privilege users to cause the server to make HTTP requests to internal addresses - including loopback, RFC-1918 private ranges, and cloud metadata endpoints such as 169.254.169.254 - by exploiting a DNS rebinding flaw in the Glide image proxy. Affected versions are statamic/cms before 5.73.24 and 6.x before 6.20.1 on sites that accept user-supplied remote image URLs. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and cloud metadata exposure make this a meaningful risk for cloud-hosted deployments.
Technical ContextAI
The root cause is CWE-367 (Time-of-Check Time-of-Use / TOCTOU race condition). Statamic CMS uses the Glide image proxy to process and serve images, including those fetched from remote URLs. The proxy validates that a user-supplied hostname resolves to a publicly routable IP address before proceeding. However, because DNS is re-resolved independently at fetch time, an attacker who controls DNS for their own domain can return a legitimate public IP during the validation check, then immediately switch the DNS record to an internal address (e.g., 127.0.0.1 or 169.254.169.254) before the actual HTTP fetch occurs. The affected package is composer/statamic/cms (pkg:composer/statamic_cms), a Laravel-based flat-file and hybrid CMS. The CVSS Scope:Changed metric reflects that the impact extends beyond Statamic itself to whatever internal services or cloud metadata endpoints are reachable from the host.
RemediationAI
The primary fix is to upgrade statamic/cms to version 5.73.24 (for 5.x deployments) or 6.20.1 (for 6.x deployments) via composer update statamic/cms. If immediate patching is not feasible, the most effective compensating control is network-layer egress filtering on the Statamic application server to block outbound HTTP requests to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and the cloud metadata address 169.254.169.254 - note this may break legitimate internal integrations. A secondary control is restricting Statamic user roles so that only fully trusted users can supply remote image URLs to Glide; this limits the attack surface without disabling the feature. On AWS, enabling IMDSv2 (requiring a PUT-based token before metadata access) prevents metadata exfiltration even if SSRF is achieved, with no functional trade-offs for most deployments. Advisory: https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today