CVE-2026-54242

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.24 Statamic versions prior to 6.20.1

Description The Glide image proxy contains a flaw where URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php can be bypassed via DNS rebinding. DNS rebinding is a technique that allows a client to bypass the Same-Origin Policy by changing the IP address associated with a domain name between the time of validation and the time of the actual request. In this case, a remote hostname is initially validated as publicly routable but is resolved again during the image fetch process. An attacker controlling the DNS can rebind the hostname to an internal address, forcing the server to make HTTP requests to loopback, private network, or cloud metadata endpoints. This issue affects sites that pass user-supplied URLs to Glide.

Recommendations Update to version 5.73.24. Update to version 6.20.1.