Search for packages
| purl | pkg:composer/craftcms/cms@3.8.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-27rw-tqt8-b3cw
Aliases: CVE-2023-2817 GHSA-7x94-jx75-3gh6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. |
Affected by 47 other vulnerabilities. |
|
VCID-5h73-3z9j-xqb8
Aliases: CVE-2023-40035 GHSA-44wr-rmwq-3phw |
Craft CMS vulnerable to Remote Code Execution via validatePath bypass Bypassing the validatePath function can lead to potential Remote Code Execution (Post-authentication, ALLOW_ADMIN_CHANGES=true) |
Affected by 10 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
VCID-82fq-7xbq-pkd4
Aliases: CVE-2023-33197 GHSA-6qjx-787v-6pxr |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6. |
Affected by 50 other vulnerabilities. |
|
VCID-e4ax-kekp-xud6
Aliases: CVE-2023-30179 GHSA-3x74-v64j-qc3f |
Improper Control of Generation of Code ('Code Injection') CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. |
Affected by 55 other vulnerabilities. |
|
VCID-efkn-13cf-97c3
Aliases: CVE-2026-27129 GHSA-v2gc-rm6g-wrw9 |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution The SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)). |
Affected by 23 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-gbct-7xjg-quf4
Aliases: CVE-2023-31144 GHSA-j4mx-98hw-6rv6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms/cms. |
Affected by 16 other vulnerabilities. Affected by 54 other vulnerabilities. |
|
VCID-gqy1-6u5a-hkeu
Aliases: CVE-2023-33495 GHSA-m3v5-gjj9-rg24 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft CMS through 4.4.9 is vulnerable to HTML Injection. |
Affected by 48 other vulnerabilities. |
|
VCID-ksxr-4r5f-w7ck
Aliases: CVE-2023-36260 GHSA-6p78-f7h9-6838 |
Craft CMS Feed-Me An issue discovered in Craft CMS version 4.6.1. allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected. |
Affected by 0 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
VCID-kts7-xtbb-tqgy
Aliases: CVE-2023-33194 GHSA-3wxg-w96j-8hq9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6. |
Affected by 15 other vulnerabilities. Affected by 50 other vulnerabilities. |
|
VCID-nyqy-y3dw-eyer
Aliases: CVE-2025-35939 GHSA-7vrx-9684-xrf2 |
Affected by 40 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
|
VCID-pggs-g9c8-w7d1
Aliases: CVE-2025-68456 GHSA-v64r-7wg9-23pr |
Unauthenticated Craft CMS users can trigger a database backup Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.Resources: https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 33 other vulnerabilities. Affected by 40 other vulnerabilities. |
|
VCID-pjsn-x6mp-57c9
Aliases: CVE-2024-52292 GHSA-cw6g-qmjq-6w2w |
Affected by 43 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
|
VCID-r8ea-btqd-uuac
Aliases: CVE-2023-30130 GHSA-fjx5-xm7q-whvj |
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. |
Affected by 17 other vulnerabilities. |
|
VCID-s9mh-xu8b-fqgf
Aliases: CVE-2026-27127 GHSA-gp2f-7wcm-5fhx |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints. |
Affected by 23 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-t5h6-xvev-f3g7
Aliases: CVE-2025-68437 GHSA-x27p-wfqw-hfcc |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.References: https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 33 other vulnerabilities. Affected by 40 other vulnerabilities. |
|
VCID-w9cn-xgye-jber
Aliases: CVE-2025-32432 GHSA-f3gw-9ww9-jmc3 |
Affected by 5 other vulnerabilities. Affected by 40 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
|
VCID-wx6u-ss6p-3ue3
Aliases: CVE-2024-56145 GHSA-2p6p-9rc9-62j9 |
Affected by 6 other vulnerabilities. Affected by 42 other vulnerabilities. Affected by 45 other vulnerabilities. |
|
|
VCID-z48z-h23a-5qag
Aliases: CVE-2024-21622 GHSA-j5g9-j7r4-6qvx |
Improper Privilege Management Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. |
Affected by 9 other vulnerabilities. Affected by 47 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||