Lucene search
K

CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host

🗓️ 09 Feb 2026 19:33:24Reported by GoogleType 
osv
 osv
🔗 osv.dev👁 5 Views

Authenticated attacker can use save images Asset to exfiltrate Amazon Web Services credentials via internal domain bypass and non image extensions.

Related
Refs

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation