CVE-2026-41130 — cms
Fix: craftcms/cms@ebe7e85CVE-2026-41130 is a Server-Side Request Forgery (SSRF) vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below.
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-41130.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
craftcms/cms🐘craftcms/cmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources.
When trustedHosts is not explicitly restricted (default configuration), the application trusts the client-supplied Host header.
This allows an attacker to control the derived baseUrl, which is used in prefix validation inside actionResourceJs().
By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF).
Details
The vulnerability exists in AppController::actionResourceJs().
The function validates that the url parameter starts with assetManager->baseUrl. However, baseUrl is derived from the current request host. If trustedHosts is not configured, the Host header is fully attacker-controlled.
Attack chain:
- Attacker sends request with controlled
Hostheader. - Application derives
baseUrlfrom the malicious Host. urlparameter is required to start with thisbaseUrl.- Validation passes.
- Guzzle performs a server-side HTTP request to the attacker-controlled host.
- SSRF occurs.
This does not rely on string parsing bypass. It relies on Host header trust.
PoC (safe reproduction steps)
Environment:
- Craft CMS 5.9.12
- Default configuration (no trustedHosts restriction)
- Docker deployment
-
Start a listener inside the container: python3 -m http.server 9999
-
Send a request to resource-js with a controlled Host header.
-
Observe that the internal listener receives a request (OOB confirmation).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | craftcms/cms | ≥ 5.0.0-RC1&&< 5.9.15 | 5.9.15composer require craftcms/cms:^5.9.15 |
| 🐘Packagist | craftcms/cms | ≥ 4.0.0-RC1&&< 4.17.9 | 4.17.9composer require craftcms/cms:^4.17.9 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update craftcms/cms to 5.9.15 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-41130 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Frequently Asked Questions
Is CVE-2026-41130 in your dependencies?
Find it across Packagist, including transitive dependencies.