VulnerabilityDeferred

CVE-2025-60868

Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization.

MEDIUM 6.5EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-290
Source: cve@mitre.org

References

https://gist.github.com/kasiasok/870933de18d1400fa8be88e1bcadec6c
https://statamic.com/addons/alt-design/alt-redirects/release-notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.