Craftcms Cms vulnerabilities

CVE-2026-112772 [HIGH] CWE-94 CVE-2026-112772: Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authen Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user

CVE-2026-112773 [HIGH] CWE-94 CVE-2026-112773: Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authen Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achi

CVE-2026-79987 [HIGH] CWE-470 CVE-2026-79987: A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

CVE-2026-25497 [HIGH] CWE-639 CVE-2026-25497: Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.1 Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other

CVE-2026-112776 [CRITICAL] CWE-863 CVE-2026-112776: Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-s Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across site

CVE-2026-84801 [HIGH] CWE-862 CVE-2026-84801: Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl end Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the

CVE-2026-115935 [HIGH] CWE-94 CVE-2026-115935: The app/process-api-response-headers action accepts fake Craft API response headers from any authent The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_S

CVE-2026-115938 [HIGH] CWE-1336 CVE-2026-115938: Craft CMS allows any authenticated control panel user to submit an element-search condition whose el Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/

CVE-2026-79989 [HIGH] CWE-285 CVE-2026-79989: The vulnerability allows any authenticated user to change their own password without providing the c The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permissi

CVE-2026-55794 [HIGH] CWE-94 CVE-2026-55794: Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled

CVE-2025-54417 [HIGH] CWE-94 Craft CMS has a theoretical bypass for CVE-2025-23209 Craft CMS has a theoretical bypass for CVE-2025-23209 **Pre-requisites:** * Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) * Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder. With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands rem

CVE-2026-84795 [CRITICAL] CWE-269 CVE-2026-84795: Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to p Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

CVE-2026-31858 [HIGH] CWE-89 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection CraftCMS's `ElementSearchController` Affected by Blind SQL Injection The `ElementSearchController::actionSearch()` endpoint is missing the `unset()` protection that was added to ElementIndexesController in [GHSA-2453-mppf-46cj](https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj). The exact same SQL injection vulnerability (including `criteria[orderBy]`, the original advisory v

CVE-2026-109305 [HIGH] CWE-1336 CVE-2026-109305: Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to i Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

CVE-2025-68456 [CRITICAL] CWE-202 CVE-2025-68456: Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to miti

CVE-2026-28783 [CRITICAL] CWE-94 CVE-2026-28783: Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS imple Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a co

CVE-2026-84796 [HIGH] CWE-639 CVE-2026-84796: Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutatio Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.

CVE-2022-29933 [HIGH] CWE-640 Improper account password reset in Craft CMS Improper account password reset in Craft CMS Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-e

CVE-2024-21622 [HIGH] CWE-269 CVE-2024-21622: Craft is a content management system. This is a potential moderate impact, low complexity privilege Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

CVE-2026-44011 [HIGH] CWE-479 CVE-2026-44011: Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS w Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live