Statamic CMS, a Laravel and Git-powered content management system, contained an SSRF vulnerability (CWE-918) in the Glide image proxy component before versions 5.73.22 and 6.18.1. The vulnerability arises because the URL validation did not normalize IP address representations before checking if the IP was public, allowing attackers to bypass these checks. An unauthenticated attacker could exploit this to make the server perform HTTP requests to internal resources such as loopback addresses, private network addresses, and cloud metadata endpoints. This issue does not affect sites running PHP 8.3 or newer. The vulnerability is addressed by updating to Statamic CMS versions 5.73.22 or 6.18.1.

An unauthenticated attacker can exploit this SSRF vulnerability to make the Statamic CMS server send HTTP requests to internal network resources, potentially exposing sensitive internal services or metadata endpoints. The impact includes limited confidentiality and integrity loss but no direct availability impact. The CVSS score of 5.4 reflects a medium severity level.

This vulnerability is fixed in Statamic CMS versions 5.73.22 and 6.18.1. Users should upgrade to these versions or later to remediate the issue. Additionally, sites running PHP 8.3 or newer are not affected. No other mitigation steps are indicated by the vendor advisory.