Server-Side Request Forgery in Craft CMS by Craft
CVE-2026-72784

6.9MEDIUM

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72784?

Craft CMS, specifically versions 5.0.0-RC1 through 5.10.6 and versions 4.0.0-RC1 through 4.18.2, is vulnerable to a server-side request forgery (SSRF). This vulnerability is exploited through the GraphQL saveAsset mutation, which allows an attacker to submit a URL that can be fetched server-side. The anti-SSRF validation is inadequate, as it does not appropriately account for addresses within CGNAT (100.64.0.0/10) and NAT64 (64:ff9b::/96) ranges, with the IP verification occurring too late in the process — after the request has been initiated. An attacker with a GraphQL token limited to asset creation can potentially expose sensitive internal HTTP content, redirect outbound GET requests to private network hosts (including those under RFC1918, loopback, and metadata categories), and enumerate available internal services.

Affected Version(s)

cms 5.0.0-RC1 < 5.10.6

cms 4.0.0-RC1 < 4.18.2

cms 5.10.6

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
vendor-advisory
https://www.vulncheck.com/advisories/craft-cms-rc1-before...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.