The vulnerability exists in Craft CMS’s GraphQL saveAsset mutation, which uses a standard IP validation function that mistakenly rejects legitimate IP addresses in hexadecimal or mixed notation. Attackers can exploit this oversight to inject URLs that bypass the blocklist and reach internal cloud metadata services, potentially exposing sensitive system information.

Craft CMS versions 4.0.0‑RC1 through 4.16.17 and 5.0.0‑RC1 through 5.8.21 are affected. Versions 4.16.18 and 5.8.22 contain the patch that corrects the validation logic.

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. The EPSS score is below 1 %, suggesting a low but non‑zero possibility of exploitation. It is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation requires authenticated access to the GraphQL API and involves using alternative IP notation to bypass the server’s address filter, enabling access to internal metadata endpoints.