PT-2026-34220 · Craft Cms · Craft Cms

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41129

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.x through 4.17.8 Craft CMS versions 5.x through 5.9.14

Description Craft CMS is a content management system (CMS) subject to Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server-side application to make requests to an unintended location. Exploitation requires specific permissions to be enabled within the GraphQL schema, specifically "Edit assets in the <VolumeName> volume" and "Create assets in the <VolumeName> volume."

Recommendations Update versions 4.x through 4.17.8 to version 4.17.9. Update versions 5.x through 5.9.14 to version 5.9.15.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41129

GHSA-3M9M-24VH-39WX

Affected Products

Craft Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-41129 · Security Note
• https://osv.dev/vulnerability/GHSA-3m9m-24vh-39wx · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-3m9m-24vh-39wx · Note
• https://github.com/craftcms/cms/commit/d20aecfaa0eae076c4154be3b17e1f9fa05ce46f · Note
• https://twitter.com/infoflowcloud/status/2048169261391077551 · Twitter Post
• https://twitter.com/CVEnew/status/2048168403509338189 · Twitter Post