【中危】cms：服务端请求伪造风险（GHSA-v5c4-wcpj-x73m）

安全情报快照 · 风险级别：中危 · CVSS：4.9 · CVE-2026-54242 · GHSA-v5c4-wcpj-x73m

先看结论

cms存在服务端请求伪造风险，< 5.73.24 受影响，建议升级至 5.73.24。

影响范围

生态	组件	受影响版本	首个修复版本
composer	`statamic/cms`	< 5.73.24	5.73.24
composer	`statamic/cms`	>= 6.0.0, < 6.20.1	6.20.1

处置建议

优先将 statamic/cms 升级至 5.73.24 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Impact

The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation. This could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints.

This affects sites that pass user-supplied URLs to Glide.

Patches

This has been fixed in 5.73.24 and 6.20.1.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。