CVE-2026-72784: 
Craft CMS vulnerability analysis and mitigation

CVE-2026-72784 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS affecting versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2. The flaw resides in the GraphQL saveAsset mutation (also referenced as save<Volume>Asset), which fetches an attacker-supplied URL server-side with incomplete anti-SSRF validation. The vulnerability was published on August 11, 2026, with the underlying security advisory (GHSA-2mx8-9ww7-p27x) originally published by the Craft CMS team on July 25, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Craft CMS Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from two compounding flaws in Craft CMS's anti-SSRF logic (GitHub Advisory). First, the validateIp() function uses PHP's FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE flags, which do not cover CGNAT addresses (100.64.0.0/10, RFC 6598) or NAT64 addresses (64:ff9b::/96), allowing requests to those ranges to pass validation (Craft CMS Advisory). Second, the only IP check is implemented in Guzzle's on_stats callback, which fires after cURL has already connected and written the response body to disk — meaning the outbound request is issued before any rejection can occur. Exploitation requires a valid GraphQL token scoped to asset-creation permissions (volumes.:create), making this a privilege-boundary violation where a low-privilege token can drive arbitrary server-side HTTP requests.

An authenticated attacker with only asset-creation GraphQL permissions can disclose the full HTTP response body from internal hosts reachable via CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, since the fetched content is saved as an asset and can be downloaded by the attacker (Craft CMS Advisory). Beyond content disclosure, the attacker can force outbound GET requests to RFC1918 private addresses, loopback interfaces, and cloud metadata endpoints (e.g., 169.254.169.254), and blindly enumerate internal hosts and ports using timing and error-response oracles — even with devMode disabled. The vulnerability does not directly impact availability but poses meaningful confidentiality and integrity risks to internal infrastructure and services (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.145% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not fully automatable per NVD SSVC assessment, as it requires a valid GraphQL token with asset-creation scope, limiting the attacker pool to authenticated users or those who have obtained such a token.

1. Obtain a GraphQL token: Acquire or compromise a Craft CMS GraphQL token scoped to volumes.:create (asset-creation) permissions on a target instance running a vulnerable version (5.0.0-RC1 to <5.10.6 or 4.0.0-RC1 to <4.18.2).
2. Identify a CGNAT/NAT64 target: Determine an internal service reachable via CGNAT (100.64.0.0/10) or NAT64 (64:ff9b::/96) ranges, or identify RFC1918/loopback/metadata endpoints to probe (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).
3. Craft the malicious GraphQL mutation: Send a saveAsset mutation with the _file: { url: "http://<internal-target>/" } parameter pointing to the desired internal URL.
4. Trigger the server-side fetch: The Craft CMS server issues an outbound GET request to the attacker-supplied URL; because validateIp() does not block CGNAT/NAT64 ranges, the request proceeds and the response body is written to disk as an asset.
5. Retrieve the response: Download the saved asset via the Craft CMS API or UI to read the full HTTP response body from the internal target, achieving content disclosure.
6. Enumerate internal services: Repeat with varying IP addresses and ports, using timing differences and the four distinct error/success response outcomes as an oracle to map internal network topology (Craft CMS Advisory, GitHub Advisory).

• Network: Unusual outbound HTTP GET requests from the Craft CMS application server to RFC1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), CGNAT ranges (100.64.0.0/10), NAT64 ranges (64:ff9b::/96), or cloud metadata endpoints (169.254.169.254).
• Logs: Craft CMS or web server access logs showing repeated GraphQL POST requests to the API endpoint containing saveAsset mutations with _file: { url: ... } parameters pointing to internal addresses; Guzzle HTTP client logs recording connections to internal hosts.
• File System: Unexpected asset files saved in Craft CMS volume storage containing internal HTTP response content (e.g., JSON metadata, HTML from internal services, cloud instance metadata).
• Application: Multiple asset-creation events from a single low-privilege GraphQL token in a short time window, especially with varied internal URL targets; asset filenames or content inconsistent with legitimate user uploads.

Upgrade Craft CMS to version 5.10.6 (for the 5.x branch) or 4.18.2 (for the 4.x branch), which contain fixes for the incomplete SSRF validation (Craft CMS Advisory). As interim mitigations, restrict GraphQL token permissions to limit or eliminate asset-creation capabilities where not strictly necessary, and implement network-level egress filtering on application servers to block outbound requests to RFC1918, CGNAT (100.64.0.0/10), NAT64 (64:ff9b::/96), loopback, and metadata endpoint ranges. Additionally, monitor GraphQL API activity for anomalous saveAsset mutations targeting internal URLs.