CVE-2026-41130: Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. This allows an attacker to control the derived baseUrl, which is used in prefix validation inside actionResourceJs(). By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF). Versions 4.17.9 and 5.9.15 patch the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41130?
CVE-2026-41130 is classified as a high severity vulnerability due to its potential for SSRF exploitation.
How do I fix CVE-2026-41130?
To fix CVE-2026-41130, upgrade your Craft CMS to version 4.17.9 or 5.9.15 or later.
Which versions of Craft CMS are affected by CVE-2026-41130?
CVE-2026-41130 affects Craft CMS versions 4.x through 4.17.8 and 5.x through 5.9.14.
What type of vulnerability is CVE-2026-41130?
CVE-2026-41130 is a host header injection vulnerability that leads to server-side request forgery (SSRF).
Can unauthenticated users exploit CVE-2026-41130?
Yes, CVE-2026-41130 can be exploited by unauthenticated users through the vulnerable `resource-js` endpoint.