CVE-2026-72784

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1

Description An issue exists in the GraphQL save<Volume>Asset mutation that allows server-side request forgery (SSRF), a technique where an attacker forces a server to make requests to an unintended location. The validateIp() function fails to cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the IP validation occurs after the request has been initiated. An attacker with a GraphQL token limited to asset-creation permissions can use this to disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts—including loopback, metadata endpoints, and RFC1918 (private network) addresses—and enumerate internal services.

Recommendations Update to version 5.10.6 or later. Update to version 4.18.2 or later.