Craft CMS is a content management system (CMS). Versions 4.0.0‑RC1 and above, prior to 4.18.0 and 5.0.0‑RC1, and above, prior to 5.10.0, are vulnerable to Server‑Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X‑Forwarded‑Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker‑controlled server and reflect it to the client with a Content‑Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.

Craft CMS installations of versions 4.0.0‑RC1 through 4.17.x and all 5.x releases prior to 5.10.0 that still use the default permissive trustedHosts configuration are affected. The issue is addressed in Craft CMS 4.18.0 and 5.10.0.

The CVSS base score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. Attack vectors are likely via crafted Host or X‑Forwarded‑Host headers, and exploitation can be performed remotely without authentication, enabling an attacker to inject arbitrary JavaScript into visitors to the site and engage in blind SSRF to internal resources.