Craft CMS versions up to 4.17.8 on the 4.x branch and 5.9.14 on the 5.x branch contain a Server‑Side Request Forgery vulnerability that enables an attacker to have the application initiate requests from the server to arbitrary URLs. The flaw is exposed through GraphQL asset upload mutations, and requires that the attacker have the "Edit assets" and "Create assets" permissions for a target volume. The vulnerability is classified as CWE‑918 and allows potential exposure of internal resources, data leakage, or attack surface expansion on the server.

Affected products are Craft CMS on the 4.x and 5.x branches. The vulnerable releases are those dated 4.17.8 or earlier on 4.x, and 5.9.14 or earlier on 5.x. The issue is fixed in 4.17.9 and 5.9.15, respectively.

The CVSS score of 5.5 indicates a moderate risk, and no EPSS score is reported. The vulnerability is not listed in CISA KEV. Attack requires specific GraphQL permissions that may not be granted to all users, which limits the exposure to environments where those permissions are enabled. A successful exploitation would let a malicious actor explore internal networks from the CMS server, potentially leading to further attacks.