CVE-2026-41129: Craft CMS SSRF Vulnerability

CVE-2026-41129 Overview

CVE-2026-41129 is a Server-Side Request Forgery (SSRF) vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists in the GraphQL mutation handling for asset uploads, where insufficient validation of URL schemes allows authenticated attackers with specific permissions to make arbitrary server-side HTTP requests. Successful exploitation could enable attackers to access internal services, scan internal networks, or exfiltrate sensitive data from protected resources.

Critical Impact
Authenticated attackers with GraphQL asset permissions can leverage SSRF to access internal network resources, potentially exposing sensitive internal services and data.

Affected Products

Craft CMS 4.x through 4.17.8
Craft CMS 5.x through 5.9.14

Discovery Timeline

2026-04-22 - CVE-2026-41129 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41129

Vulnerability Analysis

This SSRF vulnerability resides in Craft CMS's GraphQL asset mutation resolver. The issue stems from the application accepting user-supplied URLs for asset creation without properly validating the URL scheme before processing the request. While the code included hostname validation, it failed to restrict the URL scheme, allowing attackers to specify arbitrary protocols such as file://, gopher://, or dict:// to interact with internal services or read local files.

The vulnerability requires elevated privileges—specifically, the "Edit assets in the volume" and "Create assets in the volume" permissions must be enabled in the GraphQL schema. This limits the attack surface to authenticated users with administrative-level access to asset management, but in multi-tenant or shared hosting environments, this could still represent a significant risk.

Root Cause

The root cause lies in the Asset.php GraphQL resolver failing to validate the URL scheme before processing external URLs. The code path for handling remote asset URLs relied solely on hostname validation, which was insufficient to prevent SSRF attacks using alternative URL schemes that could bypass network-level controls or access local resources.

Attack Vector

An authenticated attacker with the required GraphQL permissions can craft malicious GraphQL mutations that specify URLs with arbitrary schemes. By using schemes like file:// or internal-only protocols, the attacker can:

Read local files on the server
Access internal services not exposed to the public internet
Scan internal network infrastructure
Potentially interact with cloud metadata services (e.g., http://169.254.169.254/)

The attack is network-based and requires no user interaction beyond the attacker authenticating with appropriate permissions.

php

         } elseif (!empty($fileInformation['url'])) {
             $url = $fileInformation['url'];
 
+            if (!$this->validateScheme($url)) {
+                throw new UserError("$url contains an invalid scheme.");
+            }
+
             if (!$this->validateHostname($url)) {
                 throw new UserError("$url contains an invalid hostname.");
             }

Source: GitHub Commit

The patch introduces a new validateScheme() method that checks the URL scheme before any further processing occurs, ensuring only permitted schemes (typically http:// and https://) are accepted.

Detection Methods for CVE-2026-41129

Indicators of Compromise

GraphQL mutation requests to asset endpoints containing unusual URL schemes (file://, gopher://, dict://, ftp://)
Asset creation attempts referencing internal IP addresses (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x)
Requests targeting cloud metadata endpoints (169.254.169.254)
Unexpected outbound connections from the Craft CMS application server to internal services

Detection Strategies

Monitor GraphQL query logs for createAsset or similar mutations with suspicious URL parameters
Implement Web Application Firewall (WAF) rules to detect SSRF patterns in request payloads
Review application logs for UserError exceptions related to hostname or scheme validation failures
Enable network segmentation monitoring to detect unusual server-initiated connections

Monitoring Recommendations

Configure alerting on GraphQL endpoints for requests containing non-HTTP URL schemes
Establish baseline network behavior for the CMS server and alert on deviations
Monitor for access attempts to internal-only services from the web application tier
Implement egress filtering and log all outbound connections from the CMS server

How to Mitigate CVE-2026-41129

Immediate Actions Required

Upgrade Craft CMS 4.x installations to version 4.17.9 or later
Upgrade Craft CMS 5.x installations to version 5.9.15 or later
Review GraphQL schema permissions and restrict asset creation capabilities to trusted users only
Audit logs for any suspicious GraphQL asset mutations that may indicate prior exploitation attempts

Patch Information

Security patches are available through official Craft CMS releases. Version 4.17.9 addresses this vulnerability for the 4.x branch, while version 5.9.15 patches the 5.x branch. The fix introduces scheme validation via a new validateScheme() method in the GraphQL asset resolver. For additional details, refer to the GitHub Security Advisory and the related commit.

Workarounds

Disable GraphQL asset upload functionality if not required by removing "Edit assets" and "Create assets" permissions from all GraphQL schemas
Implement network-level egress filtering to restrict outbound connections from the CMS server
Deploy a reverse proxy or WAF with SSRF detection rules in front of the Craft CMS application
Use allowlist-based URL validation at the infrastructure level if upgrading is not immediately possible

bash

# Verify Craft CMS version after upgrade
./craft version

# Review GraphQL schema permissions
./craft graphql/list-schemas