CVE-2026-54242

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP requests to internal addresses, including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. This issue is fixed in versions 5.73.24 and 6.20.1.

• CWE-367
• CWE-918

• https://github.com/statamic/cms/commit/d8f4575c425e2932f22ac030568e990be0dae2da
• https://github.com/statamic/cms/pull/14761
• https://github.com/statamic/cms/releases/tag/v5.73.24
• https://github.com/statamic/cms/releases/tag/v6.20.1
• https://github.com/statamic/cms/security/advisories/GHSA-v5c4-wcpj-x73m

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54231A content injection vulnerability was found in the ABRT post…5.5
• CVE-2026-54232vLLM is an inference and serving engine for large language m…8.8
• CVE-2026-54233vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54234vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-54235vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54236vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-54243Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5
• CVE-2026-54249Pydantic AI is a Python agent framework for building Generat…6.8
• CVE-2026-5425The Widgets for Social Photo Feed plugin for WordPress is vu…7.2
• CVE-2026-54250K3s is a fully conformant production-ready Kubernetes distri…5.8
• CVE-2026-54257Electron is a framework for writing cross-platform desktop a…9.3