PT-2026-21652 · Craft Cms · Craft Cms

Rajchowdhury240 + 1 · Published 2026-01-05 · Updated 2026-02-25 · CVE-2026-27129

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft versions 4.5.0-RC1 through 4.16.18 Craft versions 5.0.0-RC1 through 5.8.22

Description Craft is a content management system (CMS). The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, bypassing SSRF protection. This bypasses a previous security fix. Exploitation requires GraphQL schema permissions for editing assets in the VolumeName volume and creating assets in the VolumeName volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). The vulnerable component is the GraphQL Asset mutation.

Recommendations Update to Craft version 4.16.19 or later. Update to Craft version 5.8.23 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27129

GHSA-V2GC-RM6G-WRW9

GHSA-X27P-WFQW-HFCC

Affected Products

Craft Cms

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27129.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-v2gc-rm6g-wrw9 · Vendor Advisory
• https://github.com/craftcms/cms/commit/2825388b4f32fb1c9bd709027a1a1fd192d709a3 · Patch
• https://osv.dev/vulnerability/GHSA-v2gc-rm6g-wrw9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68437 · Security Note
• https://osv.dev/vulnerability/GHSA-x27p-wfqw-hfcc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27129 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27129 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc · Note
• https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 · Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 · Note
• https://twitter.com/_cvereports/status/2026351583781372277 · Twitter Post
• https://t.me/CVEtracker/45562 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1refon9/resumen_diario_de_vulnerabilidades_25022026 · Reddit Post