Detections
Analytics

SCA: security update for statamic/cms (GHSA-pf9c-ch8r-2958)

medium Tenable Cloud Security Plugin ID 442057

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the
 Glide image proxy's URL validation could be bypassed using an IP representation that wasn't normalized
 before the public-IP check. An unauthenticated user could cause the server to make HTTP requests to
 internal addresses — including loopback, private network, and cloud metadata endpoints. This affects sites
 that pass user-supplied URLs to Glide. Sites running PHP 8.3 or newer are not affected. This vulnerability
 is fixed in 5.73.22 and 6.18.1. (CVE-2026-45660)

Solution

Update the statamic/cms library and its related packages to version 5.73.22 or later.

See Also

https://github.com/advisories/GHSA-pf9c-ch8r-2958

Plugin Details

Severity: Medium

ID: 442057

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 5/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.4

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-45660

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2026

Vulnerability Publication Date: 5/18/2026

Reference Information

CVE: CVE-2026-45660

cwe: CWE-918