Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-72784: Craft CMS may expose internal network via GraphQL
CVE-2026-72784 · published 2 months ago
Summary
Versions of Craft CMS from 5.0.0‑RC1 up to 5.10.5 (and 4.0.0‑RC1 up to 4.18.1) allow a specially crafted GraphQL request to make the server fetch any URL an attacker supplies. This can reveal internal web pages or force the server to contact internal systems such as private IP addresses, loopback, or cloud metadata services. Apply the latest Craft CMS updates or restrict GraphQL token permissions to prevent unauthorized asset creation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| craftcms | cms |
< 5.10.6 < 4.18.2 |
Original advisory text
Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.
References
- https://github.com/craftcms/cms/security/advisories/GHSA-2mx8-9ww7-p27x Vendor Advisory
- https://www.vulncheck.com/advisories/craft-cms-rc1-before-ssrf-via-graphql-asset... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72784... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-72784 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Track software like this
Free during beta