6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28423

CVE-2026-28423: Statamic Vulnerable to Server-Side Request Forgery via Glide

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server. This has been fixed in 5.73.11 and 6.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28423

CVE-2026-28423:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
statamic/cms	composer	< 5.73.11	5.73.11
statamic/cms	composer	>= 6.0.0-alpha.1, < 6.4.0	6.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Statamic's Glide image manipulation feature. The root cause was the lack of input validation on URLs provided for external images, either directly or through the watermark feature. The analysis of the patch commit 3c008e0f66a72c11a1c0049a5a4044a5b3eca1b6 revealed the core of the vulnerability and the fix.

The primary vulnerable function was Statamic\Imaging\ImageGenerator::parseUrl, which used PHP's parse_url without checking if the host resolved to a private or reserved IP address. This function was called by Statamic\Imaging\ImageGenerator::generateByUrl, which is the main function for processing external image URLs.

Additionally, the Statamic\Imaging\GuzzleAdapter::get method was vulnerable to SSRF via open redirects. An attacker could provide a safe-looking URL that would redirect to an internal service, and the server would follow it.

The patch introduces a new Statamic\Imaging\RemoteUrlValidator class, which is now used in both ImageGenerator::parseUrl and as a redirect middleware in GuzzleAdapter::get. This validator ensures that any provided URL is using http or https, does not contain credentials, and resolves to a public IP address, effectively mitigating the SSRF vulnerability. The controller Statamic\Http\Controllers\GlideController::generateBy was updated to handle exceptions from this new validator, confirming it as the entry point for exploitation.

Vulnerable functions

Statamic\Imaging\ImageGenerator::parseUrl

src/Imaging/ImageGenerator.php

The `parseUrl` function in `ImageGenerator` was responsible for parsing the external image URL. The original implementation used PHP's `parse_url` function without any validation to prevent Server-Side Request Forgery (SSRF). This allowed an attacker to provide URLs pointing to internal or reserved IP addresses, which the server would then request. The patch replaces this insecure implementation with a call to a new `RemoteUrlValidator` service that properly validates the URL.

Statamic\Imaging\ImageGenerator::generateByUrl

src/Imaging/ImageGenerator.php

This function serves as an entry point for the SSRF vulnerability when processing an image from a direct URL. It relies on the vulnerable `parseUrl` method to handle the user-provided URL. An attacker could exploit this by passing a malicious URL, leading to the server making unauthorized requests to internal resources.

Statamic\Imaging\GuzzleAdapter::get

src/Imaging/GuzzleAdapter.php

The `get` method is responsible for fetching the remote image content. The original implementation was vulnerable to SSRF because it would follow HTTP redirects without validating the destination URL. The patch mitigates this by adding an `on_redirect` callback that uses `RemoteUrlValidator` to ensure that any redirected URL is safe and does not point to an internal service.

Statamic\Http\Controllers\GlideController::generateBy

src/Http/Controllers/GlideController.php

This controller method is the initial entry point for an HTTP request to generate an image. It takes user input (including the image URL or watermark parameters) and passes it to the `ImageGenerator`. By catching the `InvalidRemoteUrlException` thrown by the newly added validation logic, the patch confirms this method is part of the vulnerable execution flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.