CVE-2026-31266

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does not cover CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, and the only IP check runs after the request has already been issued. An attacker holding a GraphQL token scoped only to asset-creation permissions can disclose internal HTTP content from CGNAT/NAT64 targets, force outbound GET requests to internal hosts (including RFC1918, loopback, and metadata endpoints), and enumerate internal services.

Craft CMS versions from 5.0.0-RC1 before 5.10.7 and from 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism, allowing an authenticated attacker with control panel access to execute arbitrary code.

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.

Craft CMS prior to version 5.9.18 has a vulnerability in AssetsController::actionShowInFolder() that allows fetching the filename and full folder hierarchy of an asset without checking user permissions. Any authenticated CP user, even without volume permissions, can enumerate asset filenames and folder structures.

Craft CMS contains an input-handling flaw that allows authenticated users to inject malicious configuration and execute arbitrary commands on the server. The issue affects versions from 4.0.0 to before 4.17.12 and 5.9.18.

Craft CMS has a vulnerability that allows low-privilege users to read address data. The issue stems from a lack of schema scope filtering in GraphQL queries, enabling access to personal data of users from other groups.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via a maliciously attached Behavior. The attack requires administrator access to the Craft Control Panel.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The vulnerability requires administrator access to the Control Panel with allowAdminChanges enabled, or a non-admin account with access to the System Messages utility. A malicious payload using the Twig `map` filter in Twig-accepting text fields can lead to RCE.

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.