6.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2025-60868

GHSA ID

GHSA-rpjr-pcmr-9ppw

EPSS Score

0.06078%

CWE

CWE-290

Published

10/10/2025

Updated

10/13/2025

KEV Status

Technology

PHP

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-60868

CVE-2025-60868: Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

(GitHub Advisory)

6.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2025-60868

GHSA ID

GHSA-rpjr-pcmr-9ppw

EPSS Score

0.06078%

CWE

CWE-290

Published

10/10/2025

Updated

10/13/2025

KEV Status

Technology

PHP

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
alt-design/alt-redirect	composer	<= 1.6.3

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

T** *lt R**ir**t *.*.* ***on *or St*t*mi* **ils to *onsist*ntly strip qu*ry strin* p*r*m*t*rs w**n t** "Qu*ry Strin* Strip" ***tur* is *n**l**. **s* v*ri*tions, *n*o*** k*ys, *n* *upli**t*s *r* not r*mov**, *llowin* *tt**k*rs to *yp*ss s*nitiz*tion.

Reasoning

No *n*lysis *v*il**l*

6.5

Basic Information

Concerned about an active attack path?

CVE-2025-60868: Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

6.5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI