Statamic Vulnerable to Server-Side Request Forgery via Glide

Vulnerability

Overview

CVE-2026-28423 affects Statmatic, a Laravel and Git powered CMS. When Glide image manipulation is used in insecure mode (not the default), the image proxy can be abused by an unauthenticated attacker to make the server send HTTP requests to arbitrary URLs. This can be it directly or via the watermark feature watermark feature [1]. This Server-Side Request Forgery (SSRF) vulnerability allows an attacker to probe internal services, cloud metadata endpoints, and other hosts reachable from the server [1].

Exploitation

No authentication is required to trigger the SSRF. The insecure mode must be enabled by the administrator, which is not the default configuration [1]. An attacker can craft a request to the image proxy that includes an external URL or leverages the watermark functionality to force the server to fetch a remote resource [1 resource from an attacker-controlled or internal address [1].

Impact

Successful exploitation can lead to information disclosure from internal systems, such as cloud provider metadata (e.g., AWS, GCP/AWS/Azure instance metadata), or access to other internal services that are not intended to be exposed externally [1]. This could be a stepping stone for further attacks within the internal network.

Mitigation

The vulnerability has been fixed in versions 5.73.11 and 6.4.0 [1][2][4]. The fix includes external Glide URL validation was introduced in v5.73.11 [4] and v6.4.0 includes additional security hardening [2]. Users are strongly advised to upgrade to the latest patched version and ensure insecure mode is not enabled unless absolutely necessary.