CVE-2026-45660: Statamic Glide SSRF via IP Representation Bypass

Technical summary

The vulnerability stems from insufficient URL validation in Statamic's Glide image proxy. The public-IP check is performed after URL parsing but before IP representation normalization, creating a window where non-standard IP notations (such as octal, hexadecimal, or integer representations) can bypass the intended restrictions. An attacker crafts a URL using a disguised internal IP address—for example, an alternative numeric representation of 127.0.0.1 or 192.168.x.x—and supplies it as a user-controlled parameter to Glide. The proxy normalizes the IP only after the public-IP check passes, allowing the request to proceed to internal endpoints. This is classified as a Server-Side Request Forgery (SSRF) vulnerability under CWE-918. PHP 8.3's stricter IP validation prevents the bypass, making those deployments immune.

Business impact

This vulnerability enables attackers to conduct SSRF attacks against your internal infrastructure without authentication. An attacker could enumerate or access internal services, retrieve cloud metadata (potentially exposing API keys, instance credentials, or role information on AWS, Azure, GCP), or probe private network segments. If your Statamic instance uses Glide and accepts user-supplied image URLs, the attack surface is direct. Exposure is limited to information disclosure and minor integrity risks; no denial of service or code execution vector is present. However, in environments with permissive network segmentation or cloud deployments, metadata endpoint access could compromise authentication credentials.

Affected systems

Statamic versions 5.x prior to 5.73.22 and 6.x prior to 6.18.1 are vulnerable. The risk only materializes if your Statamic instance is configured to pass user-supplied URLs to the Glide image proxy. Deployments running on PHP 8.3 or newer are not affected due to PHP's built-in IP validation. Statamic installations on PHP 8.0, 8.1, or 8.2 with user-controllable image URL parameters require immediate attention.

Exploitability

Exploitation requires network access to the Statamic instance and knowledge that it accepts user-supplied image URLs via Glide. No authentication is needed. The attack is conceptually straightforward—craft an IP-obfuscated URL pointing to an internal endpoint—but requires some technical understanding of IP notation. The CVSS score reflects a MEDIUM severity with an access vector of Network, high complexity (AC:H indicates non-standard IP representations must be used), and confidentiality/integrity impact limited to information disclosure. While not in the CISA Known Exploited Vulnerabilities catalog, the relative simplicity and clear impact vector mean this should not be dismissed as theoretical.

Remediation

Upgrade Statamic to version 5.73.22 or 6.18.1 (or later). These releases implement proper IP normalization before the public-IP check, closing the bypass. Verify the patch version against the vendor advisory. If immediate patching is not feasible, disable user-supplied URL input to Glide or restrict the URLs accepted to a whitelist of approved domains. If running PHP 8.3 or newer, you are not vulnerable, but upgrading remains recommended for defense-in-depth and potential future issues.

Patch guidance

Apply the vendor-supplied updates: upgrade to Statamic 5.73.22 (for the 5.x line) or 6.18.1 (for the 6.x line) or newer. Test patches in a staging environment to confirm Glide functionality and any user-facing image proxy behavior remains intact. No manual configuration changes are required post-patch; the fix is transparent. If you are running PHP 8.3 or later, patching is still strongly advised for consistency and future-proofing, but the immediate exploitability risk is eliminated by the PHP runtime itself.

Detection guidance

Monitor HTTP access logs for requests to internal or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1, etc.) originating from the Glide proxy endpoint. Watch for unusual Glide URL parameters containing non-standard IP notations (octal like 0177.0.0.1, hex, or integer formats). Check for requests to cloud metadata endpoints (e.g., 169.254.169.254 for AWS, 169.254.169.254 for Azure, metadata.google.internal). Correlate these with user input logs to identify attack attempts. Implement network-level segmentation to prevent Glide from making arbitrary outbound requests, or restrict outbound connections to approved domains only.

Why prioritize this

Although CVSS 5.4 is MEDIUM, the risk warrants prompt action because: (1) exploitation requires no authentication, (2) the attack vector is straightforward for technical users, (3) successful exploitation can leak sensitive credentials or metadata, and (4) many teams may not realize Glide is configured to accept user URLs. Prioritize this above patching for lower-severity authenticated-only flaws. However, if your Statamic instance does not use Glide with user-supplied URLs, or if you run PHP 8.3+, you can defer relative to critical/high-severity issues affecting your environment.

Risk score, explained

CVSS 3.1 score of 5.4 (MEDIUM) reflects: Network-accessible attack surface (AV:N), high complexity due to the need for non-standard IP notation (AC:H), no privileges required (PR:N), no user interaction (UI:N), changed scope allowing impact on a different system (S:C), limited confidentiality impact via metadata/credential leakage (C:L), limited integrity risk from potential poisoning (I:L), and no availability impact (A:N). The score does not account for context-specific factors such as whether your Glide proxy is internet-facing or whether you rely on cloud metadata—factors that would elevate risk in certain deployments.

Frequently asked questions