CVE-2026-41129

OVERVIEW Craft CMS versions 4.x through 4.17.8 and 5.x through 5.9.15 contain a Server-Side Request Forgery vulnerability that allows attackers to make arbitrary network requests from the affected system. Exploitation requires specific GraphQL schema permissions to be enabled, specifically "Edit assets" and "Create assets" permissions within a designated volume. SEVERITY The attack vector appears to be network-based and requires authentication with specific elevated permissions, indicating moderate attack complexity. While a CVSS score was not assigned, the FAUCET Risk Score of 41.0 out of 100 suggests a moderate risk profile. The potential impact includes unauthorized access to internal resources and services accessible from the server. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence tracking lists. The extremely low EPSS score of 0.00029 indicates minimal likelihood of exploitation. The vendors have released patch versions 4.17.9 and 5.9.15 to address this issue, and users should prioritize upgrading to these versions as a preventive measure.