CVE-2026-41130
SSRF Vulnerability in Craft CMS resource-js Endpoint
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craftcms | craft_cms | From 4.0.0 (inc) to 4.17.8 (inc) |
| craftcms | craft_cms | From 5.0.0 (inc) to 5.9.14 (inc) |
| craftcms | craft_cms | 4.17.9 |
| craftcms | craft_cms | 5.9.15 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Craft CMS versions 4.x through 4.17.8 and 5.x through 5.9.14 in the `resource-js` endpoint. It allows unauthenticated users to proxy remote JavaScript resources by exploiting the way the application trusts the client-supplied Host header when the `trustedHosts` setting is not explicitly restricted.
An attacker can supply a malicious Host header, which influences the derived `baseUrl` used for prefix validation inside the `actionResourceJs()` function. This manipulation enables the attacker to make the server perform arbitrary HTTP requests, resulting in a Server-Side Request Forgery (SSRF) vulnerability.
The issue is fixed in versions 4.17.9 and 5.9.15.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to make the Craft CMS server send arbitrary HTTP requests to internal or external systems. This SSRF can be used to access internal services that are not normally exposed, potentially leading to information disclosure, unauthorized actions, or further attacks within your network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Craft CMS to versions 4.17.9 or later on the 4.x branch, or 5.9.15 or later on the 5.x branch, where the issue has been patched.
Additionally, explicitly restrict the `trustedHosts` configuration to prevent the application from trusting client-supplied Host headers, which can be exploited to perform SSRF attacks.