Craftcms Cms vulnerabilities

CVE-2026-28695 [MEDIUM] CWE-1336 Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the `create()` Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). ## Required Permi

CVE-2024-52293 [HIGH] CWE-22 CVE-2024-52293: Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePat Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

CVE-2026-28696 [HIGH] CWE-639 CVE-2026-28696: Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL dir Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The imple

CVE-2023-30130 [HIGH] CWE-94 CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

CVE-2026-32263 [HIGH] CWE-470 CVE-2026-32263: Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/ Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via "as" or "on" prefixed keys, the same attack vect

CVE-2026-72782 [MEDIUM] CWE-668 CVE-2026-72782: Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template

CVE-2018-20418 [MEDIUM] CWE-79 Craft CMS Cross-site Scripting (XSS) Vulnerability Craft CMS Cross-site Scripting (XSS) Vulnerability `index.php?p=admin/actions/entries/save-entry` in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

CVE-2024-52291 [HIGH] CWE-22 CVE-2024-52291: Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access t

CVE-2026-72786 [MEDIUM] CWE-285 CVE-2026-72786: Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow

CVE-2023-30179 [HIGH] CWE-94 Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability ## Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. [According to maintainers of Craft CMS](https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200), only adminis

CVE-2026-55791 [MEDIUM] CWE-79 CVE-2026-55791: Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5. Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can

CVE-2026-56394 [MEDIUM] CWE-22 CVE-2026-56394: Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon e Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

CVE-2024-41800 [HIGH] CWE-287 CVE-2024-41800: Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times w Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. This has been patched in Craft 5.2.3.

CVE-2026-84800 [HIGH] CWE-862 CVE-2026-84800: Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in Asset Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An

CVE-2026-44010 [HIGH] CWE-862 CVE-2026-44010: Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belongi

CVE-2024-52292 [MEDIUM] CWE-22 CVE-2024-52292: Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can

CVE-2026-27127 [MEDIUM] CWE-367 Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding ## Summary The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution **separately** from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request.

CVE-2026-55790 [HIGH] CWE-79 CVE-2026-55790: Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 t Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the pay

CVE-2026-50281 [HIGH] CWE-915 CVE-2026-50281: Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with

CVE-2026-112771 [MEDIUM] CWE-200 CVE-2026-112771: Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass becau Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traver