Skip to content
OpenAdvisories

Package · Packagist

craftcms/craft

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 5.3
    CVE-2026-25492

    Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

    Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an internal IP address, byp…

    craftcms cms craftcms/craft Packagist