Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-7qzu-6kuv-9uh1
SummaryStatamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability is fixed in 5.73.22 and 6.18.1.
Aliases
0
alias CVE-2026-45660
1
alias GHSA-pf9c-ch8r-2958
Fixed_packages
0
url pkg:composer/statamic/cms@5.73.22
purl pkg:composer/statamic/cms@5.73.22
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/statamic/cms@5.73.22
1
url pkg:composer/statamic/cms@6.18.1
purl pkg:composer/statamic/cms@6.18.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/statamic/cms@6.18.1
Affected_packages
0
url pkg:composer/statamic/cms@6.0.0-alpha.1
purl pkg:composer/statamic/cms@6.0.0-alpha.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1fy7-n7hd-87b9
1
vulnerability VCID-2ueq-n7pd-1yav
2
vulnerability VCID-3afh-kvfu-q3f6
3
vulnerability VCID-5vp8-dye1-wbd9
4
vulnerability VCID-62mz-fap3-7khn
5
vulnerability VCID-7qzu-6kuv-9uh1
6
vulnerability VCID-9chh-y51z-uqdy
7
vulnerability VCID-c8nx-d391-63bw
8
vulnerability VCID-crhs-g4rj-y3du
9
vulnerability VCID-gxn8-7hm9-g3b3
10
vulnerability VCID-kajb-u17y-7ufu
11
vulnerability VCID-nqhe-2h4b-wkc1
12
vulnerability VCID-nsp1-qqp9-g3g9
13
vulnerability VCID-pxjn-93a2-53fs
14
vulnerability VCID-s17m-ejen-bya7
15
vulnerability VCID-tys6-5sqz-dfhw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/statamic/cms@6.0.0-alpha.1
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-45660
reference_id
reference_type
scores
0
value 0.00044
scoring_system epss
scoring_elements 0.1402
published_at 2026-06-11T12:55:00Z
1
value 0.00044
scoring_system epss
scoring_elements 0.14108
published_at 2026-06-14T12:55:00Z
2
value 0.00044
scoring_system epss
scoring_elements 0.14133
published_at 2026-06-13T12:55:00Z
3
value 0.00044
scoring_system epss
scoring_elements 0.14136
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-45660
1
reference_url https://github.com/statamic/cms
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/statamic/cms
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-45660
reference_id CVE-2026-45660
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-45660
3
reference_url https://github.com/advisories/GHSA-pf9c-ch8r-2958
reference_id GHSA-pf9c-ch8r-2958
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-pf9c-ch8r-2958
4
reference_url https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958
reference_id GHSA-pf9c-ch8r-2958
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-29T19:36:25Z/
url https://github.com/statamic/cms/security/advisories/GHSA-pf9c-ch8r-2958
Weaknesses
0
cwe_id 918
name Server-Side Request Forgery (SSRF)
description The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-7qzu-6kuv-9uh1