{"id":"CVE-2026-41129","aliases":["GHSA-3m9m-24vh-39wx"],"url":"https://o3.security/vulnerability/CVE-2026-41129","summary":"Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations","details":"## Required Permissions\n\nThe exploitation requires a few permissions to be enabled in the used GraphQL schema:\n\n* \"Edit assets in the <VolumeName> volume\"\n* \"Create assets in the <VolumeName> volume\"\n\n## Details\n\nThe implementation fails to restrict the URL Scheme. While the application is intended to \"upload assets\", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands.\n\n**Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any \"127.0.0.1\" string-matching filters.\n\n**Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD).\n\n**Remediation Strategy**\n\nTo prevent mathematical IP obfuscation, the application must normalize the hostname before validation.","published":"2026-04-21T23:34:56.801Z","modified":"2026-10-28T02:30:45.302894572Z","cvss":null,"epss":{"score":0.00275,"percentile":0.19731,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"5.9.15"},{"ecosystem":"Packagist","name":"craftcms/cms","fixedVersion":"4.17.9"}],"fix":{"url":"https://github.com/craftcms/cms/commit/d20aecfaa0eae076c4154be3b17e1f9fa05ce46f","label":"craftcms/cms@d20aecf"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41129.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/cms/security/advisories/GHSA-3m9m-24vh-39wx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41129"},{"type":"FIX","url":"https://github.com/craftcms/cms/commit/d20aecfaa0eae076c4154be3b17e1f9fa05ce46f"},{"type":"PACKAGE","url":"https://github.com/craftcms/cms"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:45.302894572Z"}}