AIKIDO-2026-901226

craftcms/cms is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-2mx8-9ww7-p27x Published 3 days ago

Medium Risk

This Affects:

craftcms/cms

4.0.0 - 4.18.1

Fixed in 4.18.2

5.0.0 - 5.10.5

Fixed in 5.10.6

Are you affected? Scan for Free

TL;DR

The GraphQL save-asset mutation in Craft CMS fetches a user-supplied URL server-side, and its anti-SSRF IP validation is incomplete. Ranges such as CGNAT and NAT64 pass the filter, and the only IP check runs after the request has already connected and written the response body to disk, so a token scoped only to create assets can drive internal requests and read internal HTTP content. The behavior also allows blind enumeration of internal hosts and ports through distinct client-visible outcomes. The fix tightens IP validation and blocks the outbound request before it is issued.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you expose the GraphQL API to users who hold a token that can create assets from URLs.