EUVD-2026-292646

fkie_cve-2026-41129

Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the <VolumeName> volume" and "Create assets in the <VolumeName> volume." Versions 4.17.9 and 5.9.15 patch the issue.

GHSA-3m9m-24vh-39wx — Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Affected: Packagist: craftcms/cms

## Required Permissions

The exploitation requires a few permissions to be enabled in the used GraphQL schema:

* "Edit assets in the <VolumeName> volume" * "Create assets in the <VolumeName> volume"

## Details

The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands.

**Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any "127.0.0.1" string-matching filters.

**Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD).

**Remediation Strategy**

To prevent mathematical IP obfuscation, the application must normalize the hostname before validation.

Most recent entries from all

EUVD-2026-292646

fkie_cve-2026-41129

GHSA-3m9m-24vh-39wx — Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations