CVE-2026-55791

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-55791
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.
CVSS

No CVSS.

References
Link Resource
https://github.com/craftcms/cms/pull/18559
https://github.com/craftcms/cms/security/advisories/GHSA-c55v-343g-5xff
Configurations

No configuration.

History

25 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Craft CMS es un sistema de gestión de contenido (CMS). Las versiones 4.0.0-RC1 y superiores, anteriores a la 4.18.0, y 5.0.0-RC1 y superiores, anteriores a la 5.10.0, son vulnerables a la falsificación de petición del lado del servidor (SSRF) e inyección arbitraria de JavaScript a través del endpoint /actions/app/resource-js. Al explotar la configuración permisiva predeterminada de trustedHosts, un atacante puede envenenar la cabecera Host o X-Forwarded-Host para manipular el $baseUrl de la aplicación. Esto elude la validación interna de URL del endpoint, forzando al cliente Guzzle del backend a obtener una carga útil maliciosa de un servidor controlado por el atacante y reflejarla al cliente con una cabecera Content-Type: application/javascript. La vulnerabilidad se manifiesta cuando assetManager.cacheSourcePaths se establece en false. Este problema ha sido solucionado en las versiones 4.18.0 y 5.10.0.
Information

Published : 2026-07-02 00:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-55791

Mitre link : CVE-2026-55791

CVE.ORG link : CVE-2026-55791

JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

CWE-918

Server-Side Request Forgery (SSRF)