{"id":"CVE-2026-25494","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-25494","generatedAt":"2026-10-28T03:32:43.034Z","title":"However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.","description":"Craft is a platform for creating digital experiences.  In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.","published":"2026-02-09T20:15:58.000Z","lastModified":"2026-06-17T10:24:44.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-918"],"affected":["craftcms/craft cms"],"epss":{"score":0.00404,"percentile":0.34461,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/craftcms/cms/commit/d49e93e5ba0c48939ce5eaa6cd9b4a990542d8b2","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/craftcms/cms/releases/tag/5.8.22","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-m5r2-8p9x-hp5m","tags":["Exploit","Patch","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-25494","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}