Craft CMS fails to validate the Host header when the trustedHosts configuration is not set, allowing an attacker to manipulate the baseUrl that is used for prefix validation in the resource‑js endpoint. By supplying a crafted Host header in an unauthenticated request, the application can be made to fetch arbitrary remote resources, enabling Server‑Side Request Forgery. This flaw is a classic exposure of the application to external requests and is classified as CWE‑918.

Craft CMS versions on the 4.x branch up to and including 4.17.8 and on the 5.x branch up to and including 5.9.14 are affected. Versions 4.17.9 and newer, as well as 5.9.15 and newer, contain the fix.

The vulnerability has a CVSS score of 5.5, placing it in the moderate severity range. EPSS information is not available, and it is not listed in the CISA KEV catalog, so the current exploitation likelihood is uncertain. However, because the flaw can be triggered via unauthenticated forged Host headers, an attacker could probe internal network services or exfiltrate data that the Craft CMS instance can reach. Upgrading to a patched version removes the vulnerability.