Medium, CVSS 5.3PackagistPublished
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
CVE-2026-25492 · GHSA-96pq-hxpw-rgh8
- Affected
- Packagist craftcms/craft >= 5.0.0-RC1, <= 5.8.21; >= 3.5.0, <= 4.16.17
- Fixed in
- 5.8.224.16.18· Vendor fix available
- Issue
- - The saveimagesAsset graphql mutation allows a user to give a url of an image to download. (Url must use a domain, not a raw IP.) - Attacker sets up domain attacker.domain with an A record of something like 169.254.169.254 (special AWS metadata IP) - Attacker invokes saveimagesAsset with url: http://attacker.domain/latest/meta-data/iam/security-credentials and filename "foo.txt" - Craft fetches sensitive information on attacker's behalf, and makes it available for download at /assets/images/foo.txt - Normal checks to verify that image is valid are bypassed because of .txt extension - Normal checks to verify that url is not an IP address are bypassed because user provided a valid domain that resolves to a sensitive internal IP address Details handleUpload() in src/gql/resolvers/mutations/Assets.php contains the code that processes the saveimagesAsset mutation. It has some basic validation logic for the url parameter (source of the image) and filename parameter (what to save…
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.