CVE-2026-55791: Craft CMS SSRF Vulnerability

CVE-2026-55791 Overview

Craft CMS contains a Server-Side Request Forgery (SSRF) and arbitrary JavaScript injection vulnerability in the /actions/app/resource-js endpoint. Attackers can poison the Host or X-Forwarded-Host header to manipulate the application's $baseUrl value. The default permissive trustedHosts configuration allows this manipulation to bypass the endpoint's internal URL validation. The backend Guzzle HTTP client then fetches attacker-controlled content and reflects it to the client with a Content-Type: application/javascript header. The issue affects Craft CMS versions 4.0.0-RC1 through 4.17.x and 5.0.0-RC1 through 5.9.x when assetManager.cacheSourcePaths is set to false. Craft CMS classifies this issue under [CWE-79].

Critical Impact

Unauthenticated attackers can force Craft CMS servers to fetch and reflect arbitrary JavaScript, enabling cross-site scripting against site users and outbound SSRF from the application host.

Affected Products

• Craft CMS versions 4.0.0-RC1 through versions prior to 4.18.0
• Craft CMS versions 5.0.0-RC1 through versions prior to 5.10.0
• Instances configured with assetManager.cacheSourcePaths set to false

Discovery Timeline

• 2026-07-02 - CVE-2026-55791 published to NVD
• 2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-55791

Vulnerability Analysis

The vulnerability chains two weaknesses in Craft CMS request handling. First, the default trustedHosts configuration accepts any incoming Host or X-Forwarded-Host header value. Second, the /actions/app/resource-js endpoint uses the derived $baseUrl when validating and fetching JavaScript resources. An attacker who submits a crafted host header changes the origin the server treats as trusted. The endpoint's URL validation then approves an attacker-controlled URL because it matches the poisoned base URL. The Guzzle client retrieves the remote payload and returns it under Content-Type: application/javascript, which browsers execute in the site's origin.

Root Cause

The root cause is trust placed in client-controlled request headers when deriving $baseUrl. The permissive trustedHosts default fails to restrict allowed hostnames, and downstream validation relies on the poisoned value. This combination allows an outbound request to any host while the response body flows back to the browser as executable script.

Attack Vector

Exploitation requires only network access to the vulnerable endpoint and no authentication. An attacker sends an HTTP request to /actions/app/resource-js with a Host or X-Forwarded-Host header pointing to a server they control. The Craft CMS backend issues a Guzzle HTTP request to the attacker's server and returns the response body as JavaScript. When a victim's browser loads the resulting URL, the script executes in the context of the Craft CMS site, enabling session theft, defacement, or further browser-based attacks. Technical details are available in the GitHub Security Advisory GHSA-c55v-343g-5xff and the corresponding GitHub Pull Request #18559.

Detection Methods for CVE-2026-55791

Indicators of Compromise

• Requests to /actions/app/resource-js containing Host or X-Forwarded-Host header values that do not match the site's canonical hostname
• Outbound HTTP requests from the Craft CMS application server to unexpected external domains initiated by the Guzzle client
• Web server responses returning Content-Type: application/javascript with body content sourced from an untrusted origin

Detection Strategies

• Inspect access logs for resource-js requests where the Host header differs from the server's expected FQDN
• Correlate application-level outbound network flows with inbound requests to the resource-js endpoint to spot SSRF-generated traffic
• Review Craft CMS configuration for assetManager.cacheSourcePaths values and flag hosts where the setting is false

Monitoring Recommendations

• Alert on unexpected outbound connections from web application servers to domains outside an approved allowlist
• Monitor for JavaScript resources served from Craft CMS with bodies that fail integrity checks or reference unknown external hosts
• Log and review changes to the trustedHosts configuration and the assetManager section of config/general.php

How to Mitigate CVE-2026-55791

Immediate Actions Required

• Upgrade Craft CMS 4.x installations to version 4.18.0 or later
• Upgrade Craft CMS 5.x installations to version 5.10.0 or later
• Audit config/general.php and restrict trustedHosts to the explicit set of hostnames the site serves
• Review the assetManager.cacheSourcePaths setting and enable caching where operationally acceptable

Patch Information

Craft CMS addressed the vulnerability in versions 4.18.0 and 5.10.0. The fix is described in GitHub Pull Request #18559 and GitHub Security Advisory GHSA-c55v-343g-5xff. The patch tightens URL validation in the resource-js action and reduces reliance on client-controlled host information.

Workarounds

• Set trustedHosts in config/general.php to an explicit array of allowed hostnames rather than the default permissive value
• Set assetManager.cacheSourcePaths to true to remove the code path where the vulnerability manifests
• Deploy a Web Application Firewall rule that rejects requests to /actions/app/resource-js when the Host or X-Forwarded-Host header does not match the site's canonical domain

# Configuration example: restrict trustedHosts in config/general.php
return [
    '*' => [
        'trustedHosts' => [
            'example.com',
            'www.example.com',
        ],
        'components' => [
            'assetManager' => [
                'cacheSourcePaths' => true,
            ],
        ],
    ],
];