CVE-2026-72784: Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.6 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72784?
CVE-2026-72784 has a medium severity rating of 5.4.
How do I fix CVE-2026-72784?
To fix CVE-2026-72784, update Craft CMS to version 5.10.6 or later, or 4.18.2 or later.
What systems are affected by CVE-2026-72784?
CVE-2026-72784 affects Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2.
What type of vulnerability is CVE-2026-72784?
CVE-2026-72784 is classified as a server-side request forgery (SSRF) vulnerability.
How can CVE-2026-72784 be exploited?
CVE-2026-72784 can be exploited by an attacker who provides a malicious URL to the GraphQL save<Volume>Asset mutation, triggering server-side requests.