Skip to content
Log inStart free trial

GHSA-3m9m-24vh-39wx CVE-2026-41129

Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Medium Packagist
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.27%
Chance of exploitation in the next 30 days. Higher than 19.95% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-918 Server-Side Request Forgery (SSRF)
Fix
5.9.15
Upgrade craftcms/cms to this version or later

Description

Required Permissions

The exploitation requires a few permissions to be enabled in the used GraphQL schema:

  • "Edit assets in the <VolumeName> volume"
  • "Create assets in the <VolumeName> volume"

Details

The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no whitelist forcing http or https. This allows attackers to use the Gopher protocol to wrap raw TCP commands.

Impact: Combined with the DWORD bypass, an attacker can hit internal services without triggering any "127.0.0.1" string-matching filters.

Example Payload: gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD).

Remediation Strategy

To prevent mathematical IP obfuscation, the application must normalize the hostname before validation.

Affected versions

Packagist

PackageVulnerableFixed in
craftcms/cms
>= 5.0.0-RC1, < 5.9.15
5.9.15
craftcms/cms
>= 4.0.0-RC1, < 4.17.9
4.17.9

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

craftcms/cms Packagist → 5.9.15

composer
composer require craftcms/cms:^5.9.15

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
High
User interaction
None
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
Low
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None
Exploit maturity
Proof of concept

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7vrx-9684-xrf2
Craft CMS stores arbitrary content provided by unauthenticated users in session files
Medium Known exploited Also affects craftcms/cms
GHSA-f3gw-9ww9-jmc3
Craft CMS Allows Remote Code Execution
Critical Known exploited Also affects craftcms/cms
GHSA-x684-96hh-833x
Craft CMS has a potential RCE with a compromised security key
High Known exploited Also affects craftcms/cms
GHSA-2p6p-9rc9-62j9
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
Critical Known exploited Also affects craftcms/cms
GHSA-wg23-69c2-gjc8
Craft CMS: Passkey login accepts replayed WebAuthn assertions
Medium Also affects craftcms/cms
GHSA-957r-qf9p-67xw
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Medium Also affects craftcms/cms
GHSA-596p-6jv8-775v
Craft CMS: Authenticated leak of secret environment variables
Medium Also affects craftcms/cms
GHSA-xxpx-f366-4xpq
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
Medium Also affects craftcms/cms
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor