Is there a patch available for CVE-2026-41130?

Yes, a patch is available for CVE-2026-41130. Update the affected software to the latest version immediately.

Craft CMS CVE-2026-41130

Q: What is the CVSS score of CVE-2026-41130?

CVE-2026-41130 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-22 security-advisories@github.com

SSRF

5.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 00:59 vuln.today

Analysis Generated

Apr 22, 2026 - 00:22 vuln.today

CVE Published

Apr 22, 2026 - 00:16 nvd

MEDIUM 5.5

DescriptionGitHub Advisory

Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. This allows an attacker to control the derived baseUrl, which is used in prefix validation inside actionResourceJs(). By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF). Versions 4.17.9 and 5.9.15 patch the issue.

AnalysisAI

Server-Side Request Forgery (SSRF) in Craft CMS 4.x through 4.17.8 and 5.x through 5.9.14 allows unauthenticated attackers to proxy arbitrary remote HTTP requests via the resource-js endpoint when trustedHosts is not explicitly configured. By manipulating the Host header, attackers can control the derived baseUrl used in validation, bypassing prefix checks and forcing the server to issue requests to arbitrary destinations. Patch versions 4.17.9 and 5.9.15 address the vulnerability.

Technical ContextAI

The vulnerability exists in the actionResourceJs() method within Craft CMS's resource proxying functionality. In default configurations, the application derives the baseUrl from the client-supplied Host header without restrictive validation when trustedHosts is not explicitly set. The endpoint uses this baseUrl for prefix validation to determine which remote URLs are eligible for proxying. CWE-918 (Server-Side Request Forgery) occurs because the application accepts unvalidated user input (Host header) to construct internal URLs without proper canonicalization or allowlist enforcement. The resource-js endpoint is designed to proxy JavaScript resources but becomes a vector for SSRF when the Host header trust boundary is misconfigured. This affects both the 4.x and 5.x branches, indicating the underlying design flaw persists across major versions.

Affected ProductsAI

Craft CMS 4.x branch versions through 4.17.8 and 5.x branch versions through 5.9.14 are affected. The vulnerability does not affect versions 4.17.9 and later in the 4.x branch or 5.9.15 and later in the 5.x branch. All default installations of these versions are potentially vulnerable if the trustedHosts configuration is not explicitly restricted. Refer to the official security advisory at https://github.com/craftcms/cms/security/advisories/GHSA-95wr-3f2v-v2wh for confirmed affected version ranges.

RemediationAI

Upgrade to Craft CMS 4.17.9 or later for the 4.x branch, or 5.9.15 or later for the 5.x branch. These patched versions address the Host header validation flaw in the resource-js endpoint. For organizations unable to patch immediately, explicitly configure the trustedHosts setting in the application configuration to restrict accepted Host header values to known, legitimate domain names. This prevents the attacker from controlling the derived baseUrl through header manipulation. Document and whitelist only the specific hosts (e.g., example.com, www.example.com) that should be trusted; avoid overly permissive patterns. Note that this workaround requires application restart after configuration changes and may break legitimate multi-domain setups if not configured comprehensively. Test the trustedHosts configuration in a staging environment before production deployment to ensure no legitimate requests are blocked. Refer to the patched commit ebe7e85f1c89700d64332f72492be2e9a594e783 in the Craft CMS repository for implementation details.