GHSA-rpjr-pcmr-9ppw

Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-60868

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	alt-design/alt-redirect	< 1.6.4	1.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-60868 advisory
https://github.com/alt-design/Alt-Redirect-Addon/commit/5dc6753c7151ac994c63e18914998991b1f65cbd web
https://gist.github.com/kasiasok/870933de18d1400fa8be88e1bcadec6c web
https://github.com/alt-design/Alt-Redirect-Addon package
https://github.com/alt-design/Alt-Redirect-Addon/releases/tag/v1.6.4 web
https://statamic.com/addons/alt-design/alt-redirects/release-notes web