Executive brief
Craft CMS, a popular web content management system, contains a server-side request forgery flaw in its GraphQL API that allows asset uploads. An attacker with basic asset-creation permissions can exploit incomplete network-range validation to trigger internal HTTP requests from the server, potentially accessing internal services, reading sensitive data from restricted IP ranges (CGNAT and NAT64), and enumerating internal infrastructure without proper authorization.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the GraphQL saveVolumeAsset mutation, where user-supplied URLs are fetched server-side. The root cause is incomplete anti-SSRF validation: the validateIp() function uses PHP's FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE but fails to block CGNAT (100.64.0.0/10, RFC 6598) and NAT64 (64:ff9b::/96) address ranges. Additionally, the only IP validation check runs in Guzzle's on_stats callback after the HTTP request has already been issued and the response body written to disk, so even rejected requests complete their outbound connection. An attacker holding a GraphQL token scoped only to asset-creation can disclose internal HTTP content, force GET requests to RFC1918/loopback/metadata endpoints, and enumerate internal services through timing and response differentiation. Patches are available in versions 5.10.6 and 4.18.2.
Affected products
- Craft CMS >= 5.0.0-RC1, < 5.10.6 and >= 4.0.0-RC1, < 4.18.2
Timeline
- 2026-07-25: disclosed: GitHub Security Advisory GHSA-2mx8-9ww7-p27x published
- 2026-08-11: advisory: CVE-2026-72784 assigned and published on NVD
- 2026-08-11: patched: Patches released: CMS 5.10.6 and 4.18.2