Is CVE-2026-55791 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55791 being exploited in the wild.

How severe is CVE-2026-55791?

Critical severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.10.

Is there a fix for CVE-2026-55791?

Yes. craftcms/cms (Packagist): upgrade to 5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55791 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55791?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55791: Craft CMS SSRF and JavaScript injection via Host header poisoning

CVE-2026-55791 · Severity: critical · CVSS 4 · Published 2026-07-02

Craft CMS, a popular content management system, is vulnerable to a security flaw that allows attackers to trick the server into fetching malicious scripts from an external source. By manipulating web request headers, an attacker can force the system to serve harmful code to other users, including administrators. This can lead to unauthorized actions being performed on the site, such as the installation of malicious plugins or full site takeover if an administrator views a compromised page.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55791 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55791 being exploited in the wild.
How severe is CVE-2026-55791?: Critical severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.10.
Is there a fix for CVE-2026-55791?: Yes. craftcms/cms (Packagist): upgrade to 5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55791 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55791?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.10 or later
```
composer require craftcms/cms:^5.10
```

Technical details

A vulnerability exists in Craft CMS due to a combination of a permissive default 'trustedHosts' configuration and insecure URL validation in the 'AppController::actionResourceJs()' endpoint. An attacker can poison the 'Host' or 'X-Forwarded-Host' headers to manipulate the application's '$baseUrl', bypassing internal checks that ensure requested resources are local. The backend Guzzle client then fetches a remote payload from an attacker-controlled server and serves it with a 'application/javascript' content type. This can be leveraged for SSRF to probe internal networks or, more critically, for web cache poisoning to achieve Stored XSS and subsequent RCE via session riding. The issue is fixed in versions 4.18.0 and 5.10.0.

Affected products

craftcms cms >= 4.0.0-RC1, < 4.18.0; >= 5.0.0-RC1, < 5.10.0

Identifiers

CVE-2026-55791
GHSA-c55v-343g-5xff

Timeline

2026-03-13: other: Initial bugfix pull request opened
2026-04-21: patched: Fix merged into 4.18 branch
2026-06-16: advisory: Security advisory published by vendor
2026-07-02: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.