Craft CMS’s GraphQL Asset mutation uses gethostbyname() to validate hostnames, resolving only IPv4 addresses, an oversight identified as CWE-918. When a hostname offers only AAAA (IPv6) records, gethostbyname() returns the hostname string itself, causing the blocklist comparison to fail and the SSRF protection to be bypassed. This flaw is a direct bypass of the fix for CVE-2025-68437 and allows a malicious request to reach internal or cloud‑metadata services that the server can access.

Craft CMS versions 4.5.0‑RC1 through 4.16.18 and 5.0.0‑RC1 through 5.8.22 are affected. The vulnerability applies to the GraphQL Asset mutation endpoint and requires the same product and version identifiers used in the CWE‑918 listing.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, yet it can be abused by anyone who has GraphQL schema permissions to edit or create assets in an authenticated or misconfigured public schema. The attack requires only the ability to send a GraphQL mutation, which is often available to authenticated users with asset‑management privileges.