Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28423 Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (w… https://www.cve.org/CVERecord?id=CVE-2026-28423
Post summary
CVE-2026-28423 affects Statmatic CMS due to insecure Glide image manipulation in older versions; no further details on exploitation or mitigation are provided.
CVE-2026-28423 Server-Side Request Forgery in Statmatic CMS via Insecure Glide Image Proxy https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28423
Post summary
The text announces CVE-2026-28423 as a Server‑Side Request Forgery in Statmatic CMS caused by an insecure Glide Image Proxy.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | statamic | statamic | - | - | - |