CVE-2026-28423

Katalog CVE

CVSS 8.6 · High EPSS 0,47%

Kerentanan Server-Side Request Forgery (SSRF) pada statamic. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/statamic/cms/security/advisories/GHSA-cwpp-325q-2cvp patch · advisory vendor
• https://github.com/statamic/cms/releases/tag/v5.73.11 release notes
• https://github.com/statamic/cms/releases/tag/v6.4.0 release notes