CVE-2026-54242

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.

• CWE-367
• CWE-918

• https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da
• https://github.com/statamic/cms/pull/14761
• https://github.com/statamic/cms/releases/tag/v5.73.24
• https://github.com/statamic/cms/releases/tag/v6.20.1
• https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54235vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54236vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-54237Wavelog is web-based amateur radio logging software. From 1.…9.3
• CVE-2026-54239Faust.js is a headless WordPress toolkit. Prior to 1.8.11, t…8.8
• CVE-2026-54240libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54241libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54243Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5
• CVE-2026-54245Fleet is an open-source device management platform built on …7.6
• CVE-2026-54246Skipper is an HTTP router and reverse proxy for service comp…5.7
• CVE-2026-54247Skipper is an HTTP router and reverse proxy for service comp…4.3
• CVE-2026-54248Doco-CD is a GitOps continuous delivery tool that automatica…6.5