EUVD-2026-56108
GHSA-hvvw-h49x-4xmw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a valid asset-creation GraphQL token (PR:L); SSRF reaches systems beyond the CMS boundary (S:C); GET-only requests yield partial confidentiality and limited integrity impact with no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.
AnalysisAI
Server-side request forgery in Craft CMS's GraphQL API exposes internal networks and cloud metadata endpoints to attackers holding asset-creation-scoped tokens. The save<Volume>Asset GraphQL mutation fetches caller-supplied URLs server-side, and the validateIp() guard omits CGNAT (100.64.0.0/10) and NAT64 (64:ff9b::/96) ranges while also executing after the HTTP request has already been dispatched - meaning the check cannot prevent the unauthorized outbound connection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Craft CMS GraphQL API token with at minimum asset-creation scope permissions - fully unauthenticated exploitation is not supported by the description, and the official CVSS 4.0 PR:N rating conflicts with this requirement and should be treated as unverified. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with PR:N in the official vector conflicts directly with the CVE description, which states exploitation requires a GraphQL token scoped to asset-creation permissions - a discrepancy that should be verified against the vendor advisory before using the published vector for prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a Craft CMS API token with asset-creation scope - through theft of a CI/CD secret, a misconfigured public token, or a compromised integration account - issues a `saveAsset` GraphQL mutation supplying a URL that resolves to an internal host in the CGNAT range (e.g., 100.64.1.1) or to an IPv4-mapped address reachable via the NAT64 prefix. Because `validateIp()` does not block these ranges and executes only after the request has already been dispatched, the CMS fetches the URL and the HTTP response is returned to the attacker, enabling enumeration of internal services or extraction of cloud instance metadata credentials. … |
| Remediation | Upgrade Craft CMS to version 5.10.6 for 5.x installations or 4.18.2 for 4.x installations, as documented in the vendor advisory at https://github.com/craftcms/cms/security/advisories/GHSA-2mx8-9ww7-p27x. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today