CVE-2026-41130 is an SSRF vulnerability in Craft CMS affecting versions 4.0.0-RC1 up to 4.17.8 and 5.0.0-RC1 up to 5.9.14. The vulnerability exists in the resource-js endpoint, which proxies remote JavaScript resources. When the trustedHosts setting is left at its default (unrestricted), the server trusts the client-supplied Host header. This allows an attacker to manipulate the baseUrl used in prefix validation inside the actionResourceJs() function, enabling the server to issue arbitrary HTTP requests to attacker-controlled or internal resources. This flaw is patched in versions 4.17.9 and 5.9.15.

Successful exploitation allows an unauthenticated attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal or protected resources. This can lead to information disclosure or interaction with internal services not otherwise accessible. The CVSS 4.0 score is 5.5 (medium severity), reflecting network attack vector, no user interaction, and partial impact on confidentiality and integrity.

A fix is available in Craft CMS versions 4.17.9 and 5.9.15. Users should upgrade to these or later versions to remediate the vulnerability. If upgrading is not immediately possible, explicitly restricting the trustedHosts configuration to trusted domains can mitigate the risk by preventing the server from trusting arbitrary Host headers.