Statamic is a Laravel‑based CMS that allows unauthenticated users to exploit the Glide image manipulation component when it is configured in insecure mode. By supplying a crafted image URL or using the watermark feature, the server will request that URL on the attacker’s behalf. The vulnerability can be used to reach and read internal network services, cloud‑metadata endpoints, or any host that the web server can connect to, thereby exposing sensitive internal information and potentially enabling further attacks. This is a classic SSRF flaw that threatens confidentiality of internal resources.

Any Statamic CMS installation running a version older than 5.73.11 or 6.4.0 that has enabled Glide’s insecure mode is affected. The vulnerability is not present in newer versions where the insecure mode is disabled by default.

The CVSS score of 6.8 indicates moderate to high severity, but the EPSS score of less than 1% suggests that real‑world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers do not require authentication; a simple crafted request to a vulnerable image URL is sufficient to trigger SSRF, providing an easy attack vector that can reach private internal networks.