CVE-2026-72784: Craft CMS CMS

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.

Affected products

• Craft CMS CMS: from 5.0.0-RC1, before 5.10.6 (fixed in 5.10.6); from 4.0.0-RC1, before 4.18.2 (fixed in 4.18.2)

Published 2026-08-11. Last modified 2026-09-08.