CVE Explorer
CVE-2026-27129
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437. Exploitation requires GraphQ
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"cms","vendor":"craftcms","versions":[{"status":"affected","version":">= 4.5.0-RC1, < 4.16.19"},{"status":"affected","version":">= 5.0.0-RC1, < 5.8.23"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.7,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://github.com/craftcms/cms/commit/2825388b4f32fb1c9bd709027a1a1fd192d709a3","tags":["x_refsource_MISC"],"url":"https://github.com/craftcms/cms/commit/2825388b4f32fb1c9bd709027a1a1fd192d709a3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/references/2
{"name":"https://github.com/craftcms/cms/security/advisories/GHSA-v2gc-rm6g-wrw9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-v2gc-rm6g-wrw9"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/references/0
{"name":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc","tags":["x_refsource_MISC"],"url":"https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:69aa380be07c00505f6b2da66bd364206bf15808ca96bbe01401f3f4d8431d93 · sha256:f84eedd98b509812… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.