CVE-2026-25494: 
PHP vulnerability analysis and mitigation

CVE-2026-25494 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS affecting the saveAsset GraphQL mutation. It allows unauthenticated remote attackers to bypass IP blocklist protections by supplying alternative IP notations (hexadecimal, mixed) that PHP's filter_var(..., FILTER_VALIDATE_IP) fails to recognize, enabling access to cloud metadata services. Affected versions are 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21; patched versions are 4.16.18 and 5.8.22. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause (CWE-918: Server-Side Request Forgery) lies in src/gql/resolvers/mutations/Asset.php, where the validateHostname() method uses filter_var($hostname, FILTER_VALIDATE_IP) to block known-bad IP addresses. This PHP function only recognizes standard dotted-decimal notation, so hexadecimal representations such as 0xa9fea9fe, 0xa9.0xfe.0xa9.0xfe, or mixed notation like 169.254.0xa9fe pass validation undetected. However, the underlying HTTP client (Guzzle) correctly resolves these alternative notations to their decimal equivalents (e.g., 169.254.169.254), allowing the server to fetch content from blocked addresses including cloud instance metadata endpoints. No authentication or special privileges are required to invoke the saveAsset GraphQL mutation (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to make the Craft CMS server issue HTTP requests to internal cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially retrieving IAM credentials, instance configuration, and other sensitive cloud environment data. Stolen credentials could enable account compromise and lateral movement within the cloud infrastructure. The vulnerability has low direct impact on availability but poses meaningful confidentiality and integrity risks, particularly for Craft CMS deployments hosted in cloud environments (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory and requires no authentication, making it trivially exploitable by any network-accessible attacker (GitHub Advisory, Craft CMS Advisory). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.013% (5th percentile), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing Craft CMS instances running versions 4.0.0-RC1 through 4.16.17 or 5.0.0-RC1 through 5.8.21 using tools like Shodan or Censys, or by inspecting HTTP response headers and CMS fingerprints.
2. Identify GraphQL endpoint: Locate the Craft CMS GraphQL API endpoint, typically at /api or a configured custom path.
3. Craft malicious mutation: Construct a saveAsset GraphQL mutation using an alternative IP notation for the cloud metadata service address, bypassing the IP blocklist:

mutation {
  save_images_Asset(_file: {
    url: "http://169.254.0xa9fe/latest/meta-data/"
    filename: "metadata.txt"
  }) {
    id
  }
}

4. Submit the request: Send the mutation via HTTP POST to the GraphQL endpoint. PHP's filter_var passes the hex-encoded hostname as valid, while Guzzle resolves it to 169.254.169.254.
5. Retrieve exfiltrated data: The server fetches and saves the cloud metadata response as an asset. The attacker can then access the saved asset file to read IAM credentials, instance metadata, or other sensitive configuration data (GitHub Advisory, Craft CMS Advisory).

• Network: Outbound HTTP requests from the Craft CMS server to 169.254.169.254 or equivalent hex-encoded addresses (e.g., 0xa9fea9fe, 169.254.0xa9fe); unexpected connections to internal cloud metadata endpoints.
• Logs: Craft CMS or web server access logs showing GraphQL POST requests to the API endpoint containing saveAsset or save_*_Asset mutations with url parameters containing hex-encoded IP segments (e.g., 0xa9, 0xfe, 0xa9fe); Guzzle HTTP client logs showing requests to 169.254.169.254.
• File System: Unexpected asset files saved in the Craft CMS asset volumes with names like metadata.txt or similar, containing cloud metadata content (e.g., AWS IAM role names, instance IDs, or credential JSON).
• Process: Unusual outbound network connections initiated by the PHP-FPM or web server process to link-local addresses (169.254.0.0/16) (GitHub Advisory).

Upgrade Craft CMS to version 4.16.18 (for v4.x) or 5.8.22 (for v5.x), which fix this vulnerability by converting hex hostname segments to decimal before IP validation in validateHostname() (Patch Commit, Release 5.8.22). As an interim workaround for cloud-hosted deployments, enable IMDSv2 (Instance Metadata Service v2) on AWS instances, which requires a session token and is not accessible via simple GET requests, reducing the impact of SSRF against the metadata endpoint. Additionally, consider restricting outbound network access from the Craft CMS server to internal/link-local IP ranges at the network or firewall level (GitHub Advisory).

The vulnerability was reported by security researcher mHe4am (also referenced as angrybrad) and disclosed responsibly through GitHub's security advisory process on February 9, 2026 (Craft CMS Advisory). The researcher noted this was one of two SSRF bypass methods identified, with the second submitted as a separate advisory. No significant broader media coverage or notable community debate has been identified beyond the advisory itself.