PT-2026-34221 · Craft Cms · Craft Cms

Published 2026-04-14 · Updated 2026-04-25 · CVE-2026-41130

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.x through 4.17.8 Craft CMS versions 5.x through 5.9.14

Description The resource-js endpoint allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted, the application trusts the client-supplied Host header, allowing an attacker to control the derived baseUrl used in prefix validation inside the actionResourceJs() function. By supplying a malicious Host header, an attacker can force the server to issue arbitrary HTTP requests, resulting in Server-Side Request Forgery (SSRF), a condition where the server is coerced into making requests to an unintended location.

Recommendations Update versions 4.x through 4.17.8 to version 4.17.9. Update versions 5.x through 5.9.14 to version 5.9.15. Explicitly restrict trustedHosts to prevent the application from trusting client-supplied Host headers.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41130

GHSA-95WR-3F2V-V2WH

Affected Products

Craft Cms

References · 7

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-95wr-3f2v-v2wh · Exploit
• https://osv.dev/vulnerability/GHSA-95wr-3f2v-v2wh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41130 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/commit/ebe7e85f1c89700d64332f72492be2e9a594e783 · Note
• https://twitter.com/CVEnew/status/2048168402615951677 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048169254755725385 · Twitter Post