CVE-2025-68437: Craftcms/cms Craft CMS Vulnerable To Server-Side Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x27p-wfqw-hfcc",
  "modified" : "2026-01-06T15:52:11Z",
  "published" : "2026-01-05T18:02:37Z",
  "aliases" : [ "CVE-2025-68437" ],
  "summary" : "Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation",
  "details" : "The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume.\n\nUsers should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.\n\nReferences:\n\nhttps://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52\n\nhttps://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04\n\n---\n\n### Required Permissions\n\nThe exploitation requires a few permissions to be enabled in the used GraphQL schema:\n- \"Edit assets in the `<VolumeName>` volume\"\n- \"Create assets in the `<VolumeName>` volume\"\n\n### Steps to Reproduce\n\n1. Log in to the Craft CMS control panel as an admin.\n\n2. Create a new volume if you haven’t yet.\n\n3. Create a new schema (or use the full/public schema) and enable the permissions mentioned above in the **Required Permissions** section.\n\n4. Go to **GraphiQL**: `http://craft.local/admin/graphiql` & set the created schema.\n\n5. Run the following GraphQL mutation to upload an Asset *(Replace the `<VolumeName>` with your volume name)*:\n\n```graphql\nmutation {\n    save_<VolumeName>_Asset(_file: { \n        url: \"http://127.0.0.1:80/index.php\"\n        filename: \"poc.txt\"\n    }) {\n        id\n    }\n}\n```\n\n6. Note that the `index.php` response will be saved as `poc.txt` & its content will be accessible via the asset preview/download functionality.\n\n8. For the PoC, `http://127.0.0.1:80/index.php` was used as an example. However, the `url` parameter can be leveraged to target internal services, cloud metadata endpoints, or any arbitrary external URL.\n\n## Impact\n\nSuccessful exploitation of this SSRF vulnerability allows attackers to access internal network resources, bypass firewall rules, and conduct network reconnaissance.\n\nIn cloud environments (AWS, GCP, Azure), this can lead to the theft of sensitive credentials (e.g., IAM roles, service account tokens) from metadata endpoints, potentially resulting in the full compromise of the underlying infrastructure and the exfiltration of sensitive data.\n\n---\n\nUsers should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.\n\nUsers running Craft 3.5.0+ should update to the latest Craft 4.16.17 or 5.8.21 releases.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-RC1"
      }, {
        "fixed" : "5.8.21"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.8.20"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.5.0"
      }, {
        "fixed" : "4.16.17"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.16.16"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-68437"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/cms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-05T18:02:37Z",
    "nvd_published_at" : "2026-01-05T22:15:52Z"
  }
}