CVE-2026-27127
Description
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
How to fix
- craftcms craft_cms4.16.19, 5.8.23 or later
- craftcms/cms5.8.23, 4.16.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms craft_cms | 3.5.1 ≤ v < 4.16.19, 5.0.1 ≤ v < 5.8.23, 3.5.0, 5.0.0 | 4.16.19, 5.8.23 |
| craftcms/cmsPackagist | 5.0.0-RC1 ≤ v < 5.8.23, 3.5.0 ≤ v < 4.16.19 | 5.8.23, 4.16.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.