Craft CMS is affected by a Server-Side Request Forgery (SSRF) vulnerability combined with arbitrary JavaScript injection through the /actions/app/resource-js endpoint. The vulnerability arises from a permissive trustedHosts configuration that allows an attacker to poison the Host or X-Forwarded-Host headers, manipulating the application’s $baseUrl. This manipulation bypasses internal URL validation, causing the backend Guzzle HTTP client to fetch malicious payloads from attacker-controlled servers. When assetManager.cacheSourcePaths is false, the malicious JavaScript is reflected to clients with a Content-Type: application/javascript header, enabling injection. The vulnerability affects Craft CMS versions from 4.0.0-RC1 up to but not including 4.18.0, and from 5.0.0-RC1 up to but not including 5.10.0. The issue has been fixed in versions 4.18.0 and 5.10.0.

An unauthenticated attacker can exploit this vulnerability to cause the server to make arbitrary HTTP requests to attacker-controlled servers, resulting in Server-Side Request Forgery. Additionally, the attacker can inject arbitrary JavaScript into responses delivered to clients, potentially leading to client-side script execution. This can undermine the integrity of client interactions with the CMS and may facilitate further attacks. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate risk without requiring authentication or user interaction.

This vulnerability has been fixed in Craft CMS versions 4.18.0 and 5.10.0. Users should upgrade to these or later versions to remediate the issue. Until upgrading, review and restrict the trustedHosts configuration to prevent header poisoning and avoid setting assetManager.cacheSourcePaths to false. Patch status is not explicitly stated beyond the fixed versions; therefore, verify with the official vendor advisory for the latest remediation guidance.