CVE-2026-28423
published 2026-02-27CVE-2026-28423: Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure…
PriorityP357high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
0.38%
29.7th percentile
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| statamic | cms | < 5.73.11 | 5.73.11 |
| statamic | cms | — | — |
| statamic | cms | >= 0 < 5.73.11 | 5.73.11 |
| statamic | cms | >= 6.0.0-alpha.1 < 6.4.0 | 6.4.0 |
| statamic | statamic | < 5.73.11 | 5.73.11 |
| statamic | statamic | >= 6.0.0 < 6.4.0 | 6.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Statamic Vulnerable to Server-Side Request Forgery via Glide
osv·2026-03-01
CVE-2026-28423 [MEDIUM] Statamic Vulnerable to Server-Side Request Forgery via Glide
Statamic Vulnerable to Server-Side Request Forgery via Glide
### Impact
When Glide image manipulation is used in insecure mode (which is *not* the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server.
## Patches
This has been fixed in 5.73.11 and 6.4.0.
GHSA
Statamic Vulnerable to Server-Side Request Forgery via Glide
ghsa·2026-03-01
CVE-2026-28423 [MEDIUM] CWE-918 Statamic Vulnerable to Server-Side Request Forgery via Glide
Statamic Vulnerable to Server-Side Request Forgery via Glide
### Impact
When Glide image manipulation is used in insecure mode (which is *not* the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server.
## Patches
This has been fixed in 5.73.11 and 6.4.0.
No detection rules found.
No public exploits indexed.
2026-02-27
Published