CVE-2026-54242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54242", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T16:25:43.084Z", "datePublished": "2026-07-17T20:23:42.129Z", "dateUpdated": "2026-07-20T15:31:25.686Z"}, "containers": {"cna": {"title": "Statamic: Server-Side Request Forgery via Glide (DNS rebinding)", "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m"}, {"name": "https://github.com/statamic/cms/pull/14761", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/pull/14761"}, {"name": "https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.73.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.73.24"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.20.1"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.73.24", "status": "affected"}, {"version": ">= 6.0.0, < 6.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:23:42.129Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1."}], "source": {"advisory": "GHSA-v5c4-wcpj-x73m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T15:31:13.243124Z", "id": "CVE-2026-54242", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:31:25.686Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54242", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T16:25:43.084Z", "datePublished": "2026-07-17T20:23:42.129Z", "dateUpdated": "2026-07-20T15:31:25.686Z"}, "containers": {"cna": {"title": "Statamic: Server-Side Request Forgery via Glide (DNS rebinding)", "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m"}, {"name": "https://github.com/statamic/cms/pull/14761", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/pull/14761"}, {"name": "https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da"}, {"name": "https://github.com/statamic/cms/releases/tag/v5.73.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v5.73.24"}, {"name": "https://github.com/statamic/cms/releases/tag/v6.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/statamic/cms/releases/tag/v6.20.1"}], "affected": [{"vendor": "statamic", "product": "cms", "versions": [{"version": "< 5.73.24", "status": "affected"}, {"version": ">= 6.0.0, < 6.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-17T20:23:42.129Z"}, "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1."}], "source": {"advisory": "GHSA-v5c4-wcpj-x73m", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54242", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:31:13.243124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T15:31:21.835Z"}}]}}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "statamic", "versions": [{"status": "affected", "version": "< 5.73.24"}, {"status": "affected", "version": ">= 6.0.0, < 6.20.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1."}, {"lang": "es", "value": "Statamic es un sistema de gesti\u00f3n de contenido (CMS) impulsado por Laravel y Git. Antes de las versiones 5.73.24 y 6.20.1, la validaci\u00f3n de URL del proxy de im\u00e1genes Glide en src/Imaging/RemoteUrlValidator.php y src/Imaging/GuzzleAdapter.php pod\u00eda ser eludida usando la reasignaci\u00f3n de DNS. El nombre de host remoto se validaba como p\u00fablicamente enrutable, pero se resolv\u00eda de nuevo cuando la imagen era realmente recuperada, por lo que un atacante que controlara el DNS del nombre de host podr\u00eda reasignarlo a una direcci\u00f3n interna despu\u00e9s de la validaci\u00f3n y hacer que el servidor realizara solicitudes HTTP a direcciones internas, incluyendo bucle invertido, red privada y puntos finales de metadatos en la nube. Esto afecta a los sitios que pasan URL proporcionadas por el usuario a Glide. Este problema est\u00e1 solucionado en las versiones 5.73.24 y 6.20.1."}], "id": "CVE-2026-54242", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54242", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T15:31:13.243124Z", "version": "2.0.3"}}]}, "published": "2026-07-17T21:17:08.247", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/pull/14761"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v5.73.24"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/releases/tag/v6.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.73.24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.20.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "statamic"}, "product": "cms", "vendor": "statamic"}], "created": "2026-07-17T21:30:17.285102+00:00", "updated": "2026-07-30T23:30:08.687638+00:00", "vendors": ["statamic", "statamic$PRODUCT$cms"]}