~ / search / GHSA-pf9c-ch8r-2958

GHSA-pf9c-ch8r-2958

Statamic CMS: Server-Side Request Forgery via Glide

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-45660

Packages

EcosystemPackageAffectedFixed in
Packagist statamic/cms < 5.73.22 5.73.22
Packagist statamic/cms >= 6.0.0-alpha.1, < 6.18.1 6.18.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. ### Patches This has been fixed in 5.73.22 and 6.18.1

References

External links from the advisory. They lead to third-party sites.