CVE-2026-55791

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9

Description Craft CMS is subject to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection via the '/actions/app/resource-js' endpoint. The issue occurs when assetManager.cacheSourcePaths is set to false. An attacker can exploit the default permissive trustedHosts configuration by poisoning the Host or X-Forwarded-Host header to manipulate the $baseUrl variable. This bypasses internal URL validation in the actionResourceJs() function, causing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and return it to the client with a Content-Type: application/javascript header. If the instance is behind a caching layer, this can lead to Web Cache Poisoning, potentially resulting in Stored XSS and Remote Code Execution (RCE) by extracting the window.Craft.csrfTokenValue and performing unauthorized administrative actions.

Recommendations Update Craft CMS to version 4.18.0 or higher. Update Craft CMS to version 5.10.0 or higher. Restrict the use of the '/actions/app/resource-js' endpoint or ensure assetManager.cacheSourcePaths is not set to false as a temporary mitigation.