CVE-2025-60868

Published: Oct 10, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (2)

https://gist.github.com/kasiasok/870933de18d1400fa8be88e1bcadec6c

Source: cve@mitre.org

https://statamic.com/addons/alt-design/alt-redirects/release-notes

Source: cve@mitre.org

Timeline

No history available yet.