cvedb.io
CVE-2026-25494
MEDIUM · CVSS 6.5
EPSS exploitation probability: 0%
Published 2026-02-09T20:15:57.937 · Last modified 2026-06-17T10:24:44.127

Summary

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.

Affected products

craftcms — craft_cms

Does this affect you?

Add your gear to cvedb and we'll alert you only when craftcms ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.