Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-09 | 2 | Disclosure1General1 |
| 2026-02-10 | 1 | Disclosure1 |
CVE-2026-25494 Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses f… https://www.cve.org/CVERecord?id=CVE-2026-25494
Post summary
CVE-2026-25494 involves a flaw in Craft’s saveAsset GraphQL mutation, but the text offers no evidence of exploitation, a PoC, or a patch.
CVE-2026-25494: Craft CMS: The Art of Hexing Your Way to AWS Metadata A high-severity Server-Side Request Forgery (SSRF) vulnerability in Craft CMS allows attackers to bypass IP blocklists using alternative IP notations (hexadecimal). By abusing the d... https://cvereports.com/reports/CVE-2026-25494
Post summary
The text announces a high‑severity SSRF vulnerability in Craft CMS that lets attackers bypass IP blocklists using hexadecimal IPs, exposing AWS metadata access.
CVE-2026-25494 IP Blocklist Bypass Vulnerability in Craft CMS GraphQL Asset Mutation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25494
Post summary
This text announces CVE-2026-25494, a blocklist bypass flaw in Craft CMS's GraphQL Asset Mutation, but provides no further details on exploitation or mitigation.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |