CVE-2025-68437
published 2026-01-05CVE-2025-68437: Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save__Asset`…
PriorityP340medium6.8CVSS 3.1
AVNACLPRHUINSCCHINAN
EPSS
0.43%
34.2th percentile
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save__Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| craftcms | cms | — | — |
| craftcms | cms | — | — |
| craftcms | cms | >= 3.5.0 < 4.16.17 | 4.16.17 |
| craftcms | cms | >= 3.5.0 < 4.16.19 | 4.16.19 |
| craftcms | cms | >= 5.0.0-RC1 < 5.8.21 | 5.8.21 |
| craftcms | cms | >= 5.0.0-RC1 < 5.8.23 | 5.8.23 |
| craftcms | craft_cms | — | — |
| craftcms | craft_cms | — | — |
| craftcms | craft_cms | >= 3.5.0 < 4.16.19 | 4.16.19 |
| craftcms | craft_cms | >= 3.5.0 < 4.16.17 | 4.16.17 |
| craftcms | craft_cms | >= 3.5.1 < 4.16.19 | 4.16.19 |
| craftcms | craft_cms | >= 5.0.1 < 5.8.23 | 5.8.23 |
| craftcms | craft_cms | >= 5.0.1 < 5.8.21 | 5.8.21 |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
nvdv4.05.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa5.0MEDIUM
osv5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
ghsa·2026-02-24·CVSS 5.0
CVE-2026-27129 [MEDIUM] CWE-918 Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
The SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection.
This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)).
## Required Permissions
Exploitation requires GraphQL schema permissions for:
- Edit assets in the `` volume
- Create assets in the `` volume
These permissions may be granted to:
- Authenticated users with appropriate GraphQL schema access
- Public Schema (if misconfig
OSV
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
osv·2026-02-24·CVSS 5.0
CVE-2026-27129 [MEDIUM] Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
The SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection.
This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)).
## Required Permissions
Exploitation requires GraphQL schema permissions for:
- Edit assets in the `` volume
- Create assets in the `` volume
These permissions may be granted to:
- Authenticated users with appropriate GraphQL schema access
- Public Schema (if misconfig
OSV
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
osv·2026-02-23·CVSS 5.0
CVE-2026-27127 [MEDIUM] Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
## Summary
The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.
This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints.
## Severity
Bypass of cloud metadata SSRF protection for all blocked IPs
## Required Permissions
Exploitation requires GraphQL schema permissions for:
- Edit assets in the `` volume
GHSA
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
ghsa·2026-02-23·CVSS 5.0
CVE-2026-27127 [MEDIUM] CWE-367 Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
## Summary
The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.
This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints.
## Severity
Bypass of cloud metadata SSRF protection for all blocked IPs
## Required Permissions
Exploitation requires GraphQL schema permissions for:
- Edit assets in the `` volume
GHSA
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
ghsa·2026-01-05
CVE-2025-68437 [MEDIUM] CWE-918 Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
The Craft CMS GraphQL `save__Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targ
OSV
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
osv·2026-01-05
CVE-2025-68437 [MEDIUM] Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
The Craft CMS GraphQL `save__Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targ
No detection rules found.
No public exploits indexed.
2026-01-05
Published