CVE-2026-54242 Details
Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.
A server-side request forgery vulnerability has been identified in Statamic CMS versions prior to 5.73.24 and 6.20.1. The issue arises in the Glide image proxy's URL validation, which can be bypassed through DNS rebinding. Initially, the remote hostname is validated as publicly routable, but when the image is fetched, an attacker controlling the DNS can rebind it to an internal address. This allows the server to make HTTP requests to internal resources, including loopback, private network, and cloud metadata endpoints. The vulnerability affects sites that pass user-supplied URLs to Glide.
Users can upgrade to Statamic CMS versions 5.73.24 or 6.20.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da | [email protected] | Source CodeVendor |
| https://github.com/statamic/cms/pull/14761 | [email protected] | Issue TrackingVendor |
| https://github.com/statamic/cms/releases/tag/v5.73.24 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/releases/tag/v6.20.1 | [email protected] | Release NotesVendor |
| https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Statamic | < 5.73.24 (semver) < 6.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |