Executive brief
Statamic is a content management system used to build and manage websites. A security flaw in its image processing component allows an attacker to trick the server into making unauthorized requests to internal systems or private cloud data. This could lead to the exposure of sensitive internal information or access to restricted administrative interfaces.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Statamic's Glide image proxy due to a Time-of-Check Time-of-Use (TOCTOU) flaw in URL validation. The `RemoteUrlValidator.php` and `GuzzleAdapter.php` components validate that a hostname is publicly routable, but the hostname is resolved a second time when the image is actually fetched. An attacker controlling a malicious DNS server can use DNS rebinding to return a safe IP during validation and an internal IP (such as 127.0.0.1 or cloud metadata endpoints) during the fetch phase. This allows the attacker to probe internal networks or retrieve sensitive environment data. The issue is fixed in versions 5.73.24 and 6.20.1.
Affected products
- Statamic cms < 5.73.24, >= 6.0.0 < 6.20.1
Timeline
- 2026-06-02: patched: Fixes merged into 5.x and 6.x branches
- 2026-07-17: advisory: CVE-2026-54242 published