CVE-2026-45660— Statamic: Server-Side Request Forgery via Glide
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45660
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Statamic: Server-Side Request Forgery via Glide
Source: CVE Program / CVE List V5
Vulnerability Description
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Statamic 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Statamic是美国Statamic公司的一个基于 Laravel 构建的强大的平面文件 Cms。用于将所有内容、模板、资产和设置存储在文件而不是数据库中。 Statamic 5.73.22之前版本和6.18.1之前版本存在代码问题漏洞，该漏洞源于Glide图像代理的URL验证可被绕过，未经验证的用户可能导致服务器向内部地址发起HTTP请求，包括回环、私有网络和云元数据端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45660
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45660
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45660 (1)
- 🔗 Server-Side Request Forgery via Glide · Advisory · statamic/cms · GitHubx_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: cms
- CVE-2026-16219
Croogo CMS Admin File Manager FileManager.php isEditable pat - CVE-2026-16205
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cr - CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-54242
Statamic: Server-Side Request Forgery via Glide (DNS rebindi - CVE-2026-54244
Statamic: Incorrect authorization lets view-only users submi
Same vendor: statamic
- CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-54242
Statamic: Server-Side Request Forgery via Glide (DNS rebindi - CVE-2026-54244
Statamic: Incorrect authorization lets view-only users submi - CVE-2026-49288
Statamic CMS missing authorization on Control Panel fieldtyp - CVE-2026-49287
Statamic CMS vulnerable to unsafe method invocation via coll
Same weakness: CWE-918
- CVE-2026-57106
Data Quality Elevation of Privilege Vulnerability - CVE-2026-16910
Quay: ssrf in red hat quay notification webhooks (slack/gene - CVE-2026-56167
Azure AI Search Elevation of Privilege Vulnerability - CVE-2026-63313
9Router before 0.4.72 Server-Side Request Forgery via /v1/we - CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP V
V. Comments for CVE-2026-45660
No comments yet