Is CVE-2026-54242 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54242 being exploited in the wild.

How severe is CVE-2026-54242?

Medium severity, with a CVSS score of 4.9, published 17 July 2026.

Which products and versions are affected?

statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.73.24; Statamic = 6.0.0 = 6.0.0, < 6.20.1.

Is there a fix for CVE-2026-54242?

Yes. statamic/cms (Packagist): upgrade to 5.73.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54242 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54242?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54242: Statamic CMS SSRF via DNS rebinding in Glide image proxy

Q: Is there a fix for CVE-2026-54242?

Yes. statamic/cms (Packagist): upgrade to 5.73.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54242 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-54242?

Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54242 · Severity: medium · CVSS 4.9 · Published 2026-07-17

Statamic is a content management system used to build and manage websites. A security flaw in its image processing component allows an attacker to trick the server into making unauthorized requests to internal systems or private cloud data. This could lead to the exposure of sensitive internal information or access to restricted administrative interfaces.

Technologies: statamic/cms (Packagist), Statamic. Vendors: Packagist, Statamic.

Quick answers

Is CVE-2026-54242 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54242 being exploited in the wild.
How severe is CVE-2026-54242?: Medium severity, with a CVSS score of 4.9, published 17 July 2026.
Which products and versions are affected?: statamic/cms (Packagist) ECOSYSTEM:introduced=0,fixed=5.73.24; Statamic < 5.73.24, >= 6.0.0 < 6.20.1, < 5.73.24, >= 6.0.0, < 6.20.1.
Is there a fix for CVE-2026-54242?: Yes. statamic/cms (Packagist): upgrade to 5.73.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54242 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54242?: Check whether you run statamic/cms (Packagist) or Statamic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

statamic/cms (Packagist): upgrade to 5.73.24 or later
```
composer require statamic/cms:^5.73.24
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Statamic's Glide image proxy due to a Time-of-Check Time-of-Use (TOCTOU) flaw in URL validation. The `RemoteUrlValidator.php` and `GuzzleAdapter.php` components validate that a hostname is publicly routable, but the hostname is resolved a second time when the image is actually fetched. An attacker controlling a malicious DNS server can use DNS rebinding to return a safe IP during validation and an internal IP (such as 127.0.0.1 or cloud metadata endpoints) during the fetch phase. This allows the attacker to probe internal networks or retrieve sensitive environment data. The issue is fixed in versions 5.73.24 and 6.20.1.

Affected products

Statamic cms < 5.73.24, >= 6.0.0 < 6.20.1

Identifiers

CVE-2026-54242
GHSA-v5c4-wcpj-x73m

Timeline

2026-06-02: patched: Fixes merged into 5.x and 6.x branches
2026-07-17: advisory: CVE-2026-54242 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.