Statamic is a Laravel and Git powered content management system that uses the Glide image proxy to fetch remote images. Before releases 5.73.24 and 6.20.1, Glide validated a URL's hostname as publicly routable in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php, but performed a second DNS resolution when actually retrieving the image. By controlling the DNS entry, an attacker could rebind the hostname to a private address after validation, causing the server to make HTTP requests to internal targets such as loopback, private network ranges, or cloud metadata endpoints. The vulnerability enables server‑side request forgery and is an input‑validation flaw (CWE‑367) that permits unauthorized outbound network access (CWE‑918).

Statamic CMS installations that use Glide for remote image handling are impacted. The issue exists in all releases before 5.73.24 for the 5.x branch and before 6.20.1 for the 6.x branch. Sites that accept user‑supplied URLs to Glide and do not otherwise restrict outbound traffic are susceptible.

The CVSS score is 4.9, indicating a moderate severity. The EPSS score is less than 1%, showing a very low likelihood of exploitation observed in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted URL to Glide and control the DNS for the target hostname; once an internal address is rebound, the server will perform the request, potentially exposing sensitive data or facilitating further attacks. Because the flaw is limited to outbound requests, the attack surface is confined to the web application layer and does not require authentication to the CMS.