---
title: "CVE-2026-55791: Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs"
url: https://erroneo.us/security/cve/CVE-2026-55791/
description: "CVE-2026-55791 (craftcms/cms (Composer (PHP))): Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-01
date_modified: 2026-07-02
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-55791"
kev: false
cvss: 6.9
epss: 0.00464
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-55791: Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 39: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 39% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes craftcms/cms (Composer (PHP)) >= 5.0.0-RC1, < 5.10, fixed in 5.10 ; craftcms/cms (Composer (PHP)) >= 4.0.0-RC1, < 4.18, fixed in 4.18 . Check your lockfile, including transitive dependencies.

## What it is

Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.

## Affected packages

- Composer (PHP) `craftcms/cms` >= 5.0.0-RC1, < 5.10 → fixed: 5.10
- Composer (PHP) `craftcms/cms` >= 4.0.0-RC1, < 4.18 → fixed: 4.18

## Affected products (CVE record)

- craftcms cms: >= 5.0.0-RC1, < 5.10.0, >= 4.0.0-RC1, < 4.18.0

## Severity

- GitHub_M CVSS 4.0: 6.9 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.2 `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 0.46% probability of exploitation activity in the next 30 days; percentile 39.

## Sources

- [GitHub Advisory GHSA-c55v-343g-5xff](https://github.com/advisories/GHSA-c55v-343g-5xff)
- [CVE.org record CVE-2026-55791](https://www.cve.org/CVERecord?id=CVE-2026-55791)
- [NVD entry CVE-2026-55791](https://nvd.nist.gov/vuln/detail/CVE-2026-55791)
- [github.com](https://github.com/craftcms/cms/security/advisories/GHSA-c55v-343g-5xff)
- [github.com](https://github.com/craftcms/cms/pull/18559)

---
Source page: https://erroneo.us/security/cve/CVE-2026-55791/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt