VULNERABILITY INTELLIGENCE

CVE-2025-60868

CVSS score6.5 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2025-10-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.

Weakness classification

  • CWE-290: Authentication Bypass by Spoofing

Primary references