Craft Cms
Monthly
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
Privilege-gated remote code execution in Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 allows users with template-execution rights-such as Control Panel administrators or any account permitted to author or execute Twig templates-to bypass the Twig create() blocklist by supplying case-varied class names such as 'splfileobject'. Successful abuse can instantiate PHP's SplFileObject to read .env secrets or write a PHP file into the webroot, leading to remote code execution. The official CVSS 4.0 vector lists 8.7 with PR:N, but the independent assessment treats this as privilege-gated (CVSS 3.1 PR:H) and not exploitable by remote unauthenticated attackers against a default install; no public exploit was identified at time of analysis.
Authenticated administrator accounts on Craft CMS 5.8.0 through 5.10.x can achieve remote code execution by submitting a crafted JSON-string field layout to ContentBlock::setFieldLayout() that embeds Yii 'as X' or 'on X' configuration keys, which slip past the platform's cleanseConfig() sanitization and let an attacker attach arbitrary behavior classes and event handlers that run OS commands as the web user and expose stored secrets. Exploitation is gated on the allowAdminChanges setting being enabled and on the attacker already holding admin control-panel access, so hardened production installs with that setting disabled (the recommended posture) are not reachable and the realistic attack surface is materially narrower than the 8.7 score suggests; no public exploit has been identified at time of analysis and no CISA KEV entry exists.
Authenticated Control Panel users on Craft CMS 5.0.0 through 5.10.x can escape the Twig sandbox and achieve remote code execution by supplying uncleansed criteria to the getNext, getPrev, or getOwners element-query methods. The injected Yii 'as' or 'on' configuration keys attach a malicious behavior or event handler that executes as the web server user when the query runs. No public exploit code or CISA KEV entry was identified at time of analysis; the primary barrier is the requirement for a valid Control Panel account.
Remote code execution in Craft CMS 5.0.0 through 5.10.x lets authenticated Control Panel users escape the Twig sandbox by supplying attacker-controlled 'as' or 'on' keys to Asset::getMimeType transforms, which are passed unfiltered into Craft::createObject and can attach malicious behaviors or event handlers that execute as the PHP web user. The CVSS 4.0 score is 8.7 (and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a high-integrity and high-availability impact once a Control Panel session is obtained. No public exploit code has been identified at the time of analysis and there is no CISA KEV confirmation, so the practical risk is concentrated in environments where Control Panel access is broadly granted, weakly protected, or susceptible to credential phishing or reuse; the fixed release is 5.11.0.
Authenticated code injection in Craft CMS 4.x and 5.x allows a control panel user holding the performUpdates permission (or access to the Updates utility) to execute arbitrary code on the server by submitting a crafted 'updates' request to AppController::actionCacheUpdates. The endpoint forwards the raw request parameter into UpdatesModel without applying Component::cleanseConfig(), so an attacker can inject Yii behavior and event-handler configuration keys such as 'as' or 'on' - for example an AttributeTypecastBehavior gadget - and achieve remote code execution. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (High, 8.7 in the vendor's CVSS 4.0 scoring), and no public exploit code was identified at time of analysis; the practical barrier is the privileged-account requirement, which limits realistic exposure to malicious insiders, over-provisioned admin accounts, or environments where a control panel credential has already been compromised.
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Craft CMS versions 5.0.0-RC1 through 5.11.0 improperly authorize the GraphQL draftCreator and revisionCreator fields, allowing clients with only elements.drafts:read or elements.revisions:read scopes to retrieve PII (email, username, full name, postal address) of all draft/revision authors, typically editors and administrators. Unauthenticated exploitation is possible only if the operator has enabled the public GraphQL schema with those draft/revision scopes-a non-default configuration; otherwise a valid GraphQL token holding those scopes is required. The flaw is rated CVSS 4.0 8.7 (confidentiality-only) and is fixed in 5.11.0; no public exploit code has been identified at time of analysis.
Server-side template injection in Craft CMS 5.10.0 through 5.10.12 allows an authenticated low-privilege control-panel user with edit rights on even a single element type to execute arbitrary PHP code and fully compromise the server. The bug is an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() redirect sink stayed unsandboxed, and the same patch introduced a self-signing oracle in Cp::elementLabelHtml(); because Craft/Yii HMAC tokens are not bound to a parameter name, a token minted over attacker-controlled Twig for returnUrl can be replayed as the redirect POST parameter. Exploitation requires a valid CP account with element-edit permissions (PR:L, no user interaction); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released patch is Craft CMS 5.10.13.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Information disclosure in Craft CMS 5.0.0 through 5.10.12 can expose environment variables, secrets, database credentials, and other sensitive values when an independently occurring MySQL outage causes the application to treat the site as not installed. An unauthenticated attacker per the CVSS PR:N vector can reach anonymous installer actions such as install/validate-site if they previously obtained a valid guest session cookie and matching CSRF token and that session remains valid during the outage, then submit a predictable variable name and receive its expanded value. The flaw is gated by multiple stacked prerequisites, including an outage the attacker cannot induce and a pre-positioned valid session, and no public exploit identified at time of analysis; Craft CMS 5.10.13 contains the vendor fix.
SQL injection in Craft CMS ElementSearchController allows authenticated control panel users to execute arbitrary SQL queries and extract complete database contents through the criteria[where] and criteria[orderBy] parameters. The vulnerability exists because a previous SQL injection fix applied to ElementIndexesController was never implemented in this endpoint. An attacker with any control panel user account can exploit this via boolean-based blind injection without requiring administrative privileges.
Remote code execution in Craft CMS 5 allows authenticated Control Panel users with basic access (including non-admin roles like Author or Editor) to execute arbitrary code by injecting malicious Twig templates through condition rule parameters. The vulnerability exploits an unsandboxed template rendering function that bypasses all security hardening settings, affecting versions prior to 5.9.9 and 4.17.4. No patch is currently available for this HIGH severity vulnerability.
Remote code execution in Craft CMS versions before 5.8.22 and 4.16.18 can be achieved by authenticated administrators or users with System Messages access by injecting malicious Twig payloads through the map filter in configurable text fields. An attacker with admin-level privileges and allowAdminChanges enabled, or non-admin access to System Messages utilities, can execute arbitrary code on the affected server. A patch is available and users should update immediately to mitigate this risk.
Code injection bypass in Craft CMS before 5.9.0-beta.1/4.17.0-beta.1 via blocklist evasion. Patch available.
RCE in Craft CMS before 4.17.0-beta.1/5.9.0-beta.1 via template injection for authenticated admins. PoC and patch available.
Craft is a content management system (CMS). [CVSS 7.5 HIGH]
Remote code execution in Craft CMS 5.8.21 allows authenticated administrators to execute arbitrary PHP code through Server-Side Template Injection in the create() Twig function combined with Symfony Process gadget chains. Public exploit code exists for this vulnerability, which bypasses the previous patch for CVE-2025-57811. Updates are available in Craft CMS 5.9.0-beta.1 and 4.17.0-beta.1.
Craft is a platform for creating digital experiences. [CVSS 7.2 HIGH]
Craft CMS versions 4.0.0-RC1 to 4.17.0 and 5.0 to 5.9.0 contain a privilege escalation vulnerability in the GraphQL API that allows authenticated users with write access to one asset volume to modify or transfer assets across any other volume, including restricted ones they should not access. The vulnerability stems from insufficient authorization validation in the saveAsset mutation, which verifies permissions against the intended volume but fails to confirm the target asset actually belongs to that volume. An attacker with limited asset write permissions can exploit this to gain unauthorized access to and manipulate sensitive assets in protected volumes.
SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel users to execute arbitrary SQL queries via the criteria[orderBy] parameter in the element-indexes/get-elements endpoint. The vulnerability stems from insufficient input sanitization in the ORDER BY clause, enabling attackers to manipulate database queries. Public exploit code exists for this high-severity vulnerability, and patches are available in versions 4.16.18 and 5.8.22.
Craft CMS stores arbitrary content provided by unauthenticated users in session files. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 33.1%.
Craft CMS versions 3.x through 5.x contain a critical remote code execution vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on the server, actively exploited in the wild before patches were released.
Craft CMS 4 and 5 contain a remote code execution vulnerability exploitable when the application's security key has been compromised, allowing attackers with the key to execute arbitrary code on the server.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Craft CMS is a platform for creating digital experiences. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Authenticated Craft CMS control-panel users holding viewEntries and viewPeerEntries (but not savePeerEntries) can silently reorder Matrix blocks and Addresses belonging to other authors' entries in Craft CMS 5.0.0 through 5.10.12 by POSTing directly to the actions/nested-elements/reorder endpoint. The flaw is a missing-authorization condition: the read-only entry view hands the session a manageNestedElements::<ownerId>::field:<handle> flag, and the reorder action trusts that flag without re-verifying the caller's save permission on the owner element, unlike the corresponding delete endpoint. Impact is limited to integrity of sort order (no read, creation, or deletion of content) and requires valid CP credentials plus a multi-author deployment with shared peer content, so it rates 5.3 (CVSS 4.0) and the low end of the integrity-only range; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). A vendor-released patch exists in 5.10.13.
Reflected XSS in Craft CMS versions before 5.9.7 and 4.17.3 allows remote attackers to execute arbitrary JavaScript in users' browsers via malicious return URLs that bypass insufficient sanitization. The vulnerability exists because the patch for a prior issue relied on strip_tags() to filter URLs, which fails to block dangerous URL schemes like javascript:. An attacker can craft a malicious link that, when clicked by an authenticated user, steals session cookies or performs actions on their behalf.
Unauthenticated attackers can generate preview tokens in Craft CMS versions prior to 4.17.4 and 5.9.7 by exploiting a CSRF vulnerability in the /actions/preview/create-token endpoint, which lacks proper token validation and HTTP method restrictions. An attacker can force a logged-in editor to create an attacker-controlled preview token that grants unauthorized access to unpublished content. This attack requires user interaction but allows the attacker to view sensitive content without authentication.
Unauthenticated attackers can trigger activation emails for pending user accounts in Craft CMS versions prior to 5.9.0-beta.2 and 4.17.0-beta.2 by exploiting an unprotected endpoint that lacks permission checks. If an attacker controls the target user's email address, they can complete account activation and gain unauthorized system access. A patch is available in the latest beta versions.
Craft CMS prior to versions 5.9.0-beta.1 and 4.17.0-beta.1 fails to properly authorize the "Duplicate" entry action, allowing authenticated users to bypass UI restrictions and duplicate entries via direct requests. An attacker with minimal "View Entries" permissions can exploit predictable, incremental Entry IDs to brute-force and duplicate other users' restricted content, gaining unauthorized access to sensitive data. Public exploit code exists for this vulnerability.
Craft CMS prior to versions 4.17.0-beta.1 and 5.9.0-beta.1 allows users with entry creation permissions to arbitrarily assign authorship of new entries to any user, including administrators, through mass assignment of the authorId parameter. Public exploit code exists for this vulnerability, enabling attackers to spoof entry authorship and manipulate content attribution. The vulnerability is fixed in the specified beta releases.
Craft CMS versions 4.5.0 through 4.16.18 and 5.0.0 through 5.8.22 contain an SSRF bypass in GraphQL Asset mutations where IPv6-only hostnames bypass the security blocklist, allowing authenticated users with GraphQL asset editing permissions to perform server-side request forgery attacks. Public exploit code exists for this vulnerability, which is a regression of a previously patched SSRF issue. Authenticated users with appropriate GraphQL schema permissions can exploit this to access internal resources or perform requests to arbitrary IPv6 addresses.
Multiple usage tokens in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 can be consumed beyond their intended limits due to a race condition in token validation logic where usage checks and database updates are not atomic. An authenticated attacker with access to a valid impersonation token can exploit concurrent requests to bypass usage restrictions and reuse single-use tokens multiple times. Patches are available for affected versions.
DNS rebinding attacks in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 allow authenticated attackers to bypass SSRF protections in GraphQL asset mutations by exploiting a Time-of-Check-Time-of-Use race condition between DNS validation and HTTP requests. Attackers with appropriate GraphQL schema permissions can access blocked IP addresses and internal resources that should be restricted. Public exploit code exists for this vulnerability, which represents a bypass of the previous CVE-2025-68437 fix.
Stored XSS in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 allows high-privileged administrators to inject malicious scripts into HTML-type table columns that execute in other users' browsers. Exploitation requires admin-level access and the `allowAdminChanges` setting enabled in production, limiting the risk to environments with already-compromised administrative accounts. Patches are available in versions 4.16.19 and 5.8.23.
Stored XSS in Craft CMS Number field settings (versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21) allows authenticated users with high privileges to inject malicious scripts via the Prefix or Suffix fields, which execute when the field is viewed on user profiles. Public exploit code exists for this vulnerability. Updates to versions 4.16.18 and 5.8.22 are available to remediate the issue.
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. [CVSS 6.5 MEDIUM]
SSRF bypass in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows unauthenticated attackers to access cloud metadata endpoints and internal IP addresses through the saveAsset GraphQL mutation by exploiting Guzzle's automatic redirect handling. The vulnerability bypasses hostname and IP blocklist protections that validate only the initial request URL, enabling attackers to reach sensitive internal resources. Public exploit code exists; patched versions 4.16.18 and 5.8.22 are available.
Craft CMS versions 3.5.0-4.16.17 and 5.0.0-RC1-5.8.21 contain a server-side request forgery vulnerability in the save_images_Asset GraphQL mutation that allows authenticated users to bypass hostname validation and retrieve internal URLs by specifying domains resolving to private IP addresses. By uploading files with non-image extensions like .txt, attackers can bypass downstream validation to access sensitive data including AWS instance metadata credentials from the host system. Public exploit code exists for this vulnerability, though patches are available in versions 4.16.18 and 5.8.22.
Stored cross-site scripting in Craft CMS versions 5.0.0-RC1 through 5.8.21 allows authenticated users with high privileges to inject malicious scripts through Entry Type names that are not sanitized when displayed in the Entry Types list. An attacker exploiting this vulnerability can execute arbitrary JavaScript in the browsers of other users viewing the affected list, potentially compromising session data or performing unauthorized actions. Public exploit code exists for this vulnerability, though a patch is available in version 5.8.22 and later.
Unauthenticated remote attackers can force a Craft CMS site to execute a database backup by sending a POST request to the updater/backup admin action, because all updater/* controller actions are configured with anonymous access. Affected installations are Craft CMS 5.0.0-RC1 through 5.8.20 and Craft CMS 3.0.0 through 4.16.16, where repeated unauthenticated calls can exhaust CPU, disk, and database resources, and may expose sensitive data if a generated backup file is separately reachable. Publicly available exploit code exists, though exploitation has not been confirmed as active by CISA KEV, and EPSS is low at 0.17 percent (37th percentile), consistent with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - a genuine but moderate-priority issue. Craft's patch short-circuits the action when no migrations are pending, which limits the impact on otherwise idle sites.
Authenticated remote code execution in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 lets an attacker who already holds administrator access to the Craft Control Panel execute arbitrary PHP code on the server. The flaw is triggered by submitting a crafted Yii Behavior (yii\behaviors\AttributeTypecastBehavior) through field-layout body parameters (layoutConfig/config), abusing the 'as <behavior>' attachment syntax and a wildcard event binding so that any event fired on the tainted Component invokes an attacker-defined callable via reflection. Publicly available exploit code exists, and EPSS rates the issue at 1.12% (78th percentile), but there is no confirmed active exploitation (not in CISA KEV); the practical risk is heavily gated by the requirement for administrator privileges, so exposure is greatest where CP admin rights are delegated to lower-trust users or where admin sessions can be hijacked.
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. [CVSS 8.8 HIGH]
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). [CVSS 6.8 MEDIUM]
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. [CVSS 6.5 MEDIUM]
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 5.2), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Craft is a content management system. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity.
Craft is a content management system (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a content management system (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft is a content management system. Rated medium severity (CVSS 5.4), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Craft is a CMS for creating custom digital experiences on the web and beyond. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS through 4.4.9 is vulnerable to HTML Injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a CMS for creating custom digital experiences on the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences on the web. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS is an open source content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS is a content management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS before 3.7.29 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.7.14 allows CSV injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Craft CMS before 3.6.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
An issue was discovered in Craft CMS before 3.6.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS before 3.6.13 has an XSS vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.3.8 has stored XSS via a name field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated payment reuse in the Craft Commerce Mollie plugin (versions 2.1.1 through 4.4.2) allows anyone holding a single valid paid Mollie payment ID from the merchant's account to pair it with an arbitrary Craft Commerce transaction hash, causing that target transaction to be marked paid for its full amount and releasing goods or services without payment. No authentication or user interaction is required; the one concrete prerequisite is obtaining a genuinely paid payment ID belonging to the same merchant account, for example via a low-value legitimate purchase. The plugin is fixed in 4.4.3, and no public exploit has been identified at time of analysis.
Privilege-gated remote code execution in Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 allows users with template-execution rights-such as Control Panel administrators or any account permitted to author or execute Twig templates-to bypass the Twig create() blocklist by supplying case-varied class names such as 'splfileobject'. Successful abuse can instantiate PHP's SplFileObject to read .env secrets or write a PHP file into the webroot, leading to remote code execution. The official CVSS 4.0 vector lists 8.7 with PR:N, but the independent assessment treats this as privilege-gated (CVSS 3.1 PR:H) and not exploitable by remote unauthenticated attackers against a default install; no public exploit was identified at time of analysis.
Authenticated administrator accounts on Craft CMS 5.8.0 through 5.10.x can achieve remote code execution by submitting a crafted JSON-string field layout to ContentBlock::setFieldLayout() that embeds Yii 'as X' or 'on X' configuration keys, which slip past the platform's cleanseConfig() sanitization and let an attacker attach arbitrary behavior classes and event handlers that run OS commands as the web user and expose stored secrets. Exploitation is gated on the allowAdminChanges setting being enabled and on the attacker already holding admin control-panel access, so hardened production installs with that setting disabled (the recommended posture) are not reachable and the realistic attack surface is materially narrower than the 8.7 score suggests; no public exploit has been identified at time of analysis and no CISA KEV entry exists.
Authenticated Control Panel users on Craft CMS 5.0.0 through 5.10.x can escape the Twig sandbox and achieve remote code execution by supplying uncleansed criteria to the getNext, getPrev, or getOwners element-query methods. The injected Yii 'as' or 'on' configuration keys attach a malicious behavior or event handler that executes as the web server user when the query runs. No public exploit code or CISA KEV entry was identified at time of analysis; the primary barrier is the requirement for a valid Control Panel account.
Remote code execution in Craft CMS 5.0.0 through 5.10.x lets authenticated Control Panel users escape the Twig sandbox by supplying attacker-controlled 'as' or 'on' keys to Asset::getMimeType transforms, which are passed unfiltered into Craft::createObject and can attach malicious behaviors or event handlers that execute as the PHP web user. The CVSS 4.0 score is 8.7 (and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a high-integrity and high-availability impact once a Control Panel session is obtained. No public exploit code has been identified at the time of analysis and there is no CISA KEV confirmation, so the practical risk is concentrated in environments where Control Panel access is broadly granted, weakly protected, or susceptible to credential phishing or reuse; the fixed release is 5.11.0.
Authenticated code injection in Craft CMS 4.x and 5.x allows a control panel user holding the performUpdates permission (or access to the Updates utility) to execute arbitrary code on the server by submitting a crafted 'updates' request to AppController::actionCacheUpdates. The endpoint forwards the raw request parameter into UpdatesModel without applying Component::cleanseConfig(), so an attacker can inject Yii behavior and event-handler configuration keys such as 'as' or 'on' - for example an AttributeTypecastBehavior gadget - and achieve remote code execution. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (High, 8.7 in the vendor's CVSS 4.0 scoring), and no public exploit code was identified at time of analysis; the practical barrier is the privileged-account requirement, which limits realistic exposure to malicious insiders, over-provisioned admin accounts, or environments where a control panel credential has already been compromised.
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Information disclosure in Formie, the Craft CMS form-building plugin from Verbb, lets any authenticated control-panel user (CVSS vector PR:L, unauthenticated exploitation is not possible) read the full contents of sent form-submission notification emails - recipient headers and complete HTML bodies containing submitted form data - by enumerating notification IDs through the formie/sent-notifications/get-resend-modal-content action. The flaw bypasses the formie-viewSentNotifications permission entirely, so accounts that were never granted permission to view sent notifications can still retrieve them; it affects releases prior to 2.2.23 in the 2.x line and prior to 3.1.31 in the 3.x line. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing, so exploitability depends on an attacker first obtaining any low-privilege Craft CMS control-panel account.
Craft CMS versions 5.0.0-RC1 through 5.11.0 improperly authorize the GraphQL draftCreator and revisionCreator fields, allowing clients with only elements.drafts:read or elements.revisions:read scopes to retrieve PII (email, username, full name, postal address) of all draft/revision authors, typically editors and administrators. Unauthenticated exploitation is possible only if the operator has enabled the public GraphQL schema with those draft/revision scopes-a non-default configuration; otherwise a valid GraphQL token holding those scopes is required. The flaw is rated CVSS 4.0 8.7 (confidentiality-only) and is fixed in 5.11.0; no public exploit code has been identified at time of analysis.
Server-side template injection in Craft CMS 5.10.0 through 5.10.12 allows an authenticated low-privilege control-panel user with edit rights on even a single element type to execute arbitrary PHP code and fully compromise the server. The bug is an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() to View::renderObjectTemplate() redirect sink stayed unsandboxed, and the same patch introduced a self-signing oracle in Cp::elementLabelHtml(); because Craft/Yii HMAC tokens are not bound to a parameter name, a token minted over attacker-controlled Twig for returnUrl can be replayed as the redirect POST parameter. Exploitation requires a valid CP account with element-edit permissions (PR:L, no user interaction); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released patch is Craft CMS 5.10.13.
Remote code execution in Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 lets any authenticated non-administrator user - Control Panel access is not required - run arbitrary operating-system commands as the web-server user. Craft signs the attacker-controlled license-shun cookie with the same key and format it uses to validate signed redirect parameters (the signature is not bound to its purpose), so the attacker can transplant that signed envelope into the login redirect parameter; on a successful login Craft accepts the signature and renders the attacker-supplied bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and reaches PHP system(). Exploitation requires a password-authenticated account without active 2FA, the default request configuration, and a callable PHP system(); there is no public exploit code identified at time of analysis, and the flaw is fixed in 4.18.6 and 5.10.13. The high severity score reflects full confidentiality, integrity, and availability impact at the application level once the preconditions are met.
Information disclosure in Craft CMS 5.0.0 through 5.10.12 can expose environment variables, secrets, database credentials, and other sensitive values when an independently occurring MySQL outage causes the application to treat the site as not installed. An unauthenticated attacker per the CVSS PR:N vector can reach anonymous installer actions such as install/validate-site if they previously obtained a valid guest session cookie and matching CSRF token and that session remains valid during the outage, then submit a predictable variable name and receive its expanded value. The flaw is gated by multiple stacked prerequisites, including an outage the attacker cannot induce and a pre-positioned valid session, and no public exploit identified at time of analysis; Craft CMS 5.10.13 contains the vendor fix.
SQL injection in Craft CMS ElementSearchController allows authenticated control panel users to execute arbitrary SQL queries and extract complete database contents through the criteria[where] and criteria[orderBy] parameters. The vulnerability exists because a previous SQL injection fix applied to ElementIndexesController was never implemented in this endpoint. An attacker with any control panel user account can exploit this via boolean-based blind injection without requiring administrative privileges.
Remote code execution in Craft CMS 5 allows authenticated Control Panel users with basic access (including non-admin roles like Author or Editor) to execute arbitrary code by injecting malicious Twig templates through condition rule parameters. The vulnerability exploits an unsandboxed template rendering function that bypasses all security hardening settings, affecting versions prior to 5.9.9 and 4.17.4. No patch is currently available for this HIGH severity vulnerability.
Remote code execution in Craft CMS versions before 5.8.22 and 4.16.18 can be achieved by authenticated administrators or users with System Messages access by injecting malicious Twig payloads through the map filter in configurable text fields. An attacker with admin-level privileges and allowAdminChanges enabled, or non-admin access to System Messages utilities, can execute arbitrary code on the affected server. A patch is available and users should update immediately to mitigate this risk.
Code injection bypass in Craft CMS before 5.9.0-beta.1/4.17.0-beta.1 via blocklist evasion. Patch available.
RCE in Craft CMS before 4.17.0-beta.1/5.9.0-beta.1 via template injection for authenticated admins. PoC and patch available.
Craft is a content management system (CMS). [CVSS 7.5 HIGH]
Remote code execution in Craft CMS 5.8.21 allows authenticated administrators to execute arbitrary PHP code through Server-Side Template Injection in the create() Twig function combined with Symfony Process gadget chains. Public exploit code exists for this vulnerability, which bypasses the previous patch for CVE-2025-57811. Updates are available in Craft CMS 5.9.0-beta.1 and 4.17.0-beta.1.
Craft is a platform for creating digital experiences. [CVSS 7.2 HIGH]
Craft CMS versions 4.0.0-RC1 to 4.17.0 and 5.0 to 5.9.0 contain a privilege escalation vulnerability in the GraphQL API that allows authenticated users with write access to one asset volume to modify or transfer assets across any other volume, including restricted ones they should not access. The vulnerability stems from insufficient authorization validation in the saveAsset mutation, which verifies permissions against the intended volume but fails to confirm the target asset actually belongs to that volume. An attacker with limited asset write permissions can exploit this to gain unauthorized access to and manipulate sensitive assets in protected volumes.
SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel users to execute arbitrary SQL queries via the criteria[orderBy] parameter in the element-indexes/get-elements endpoint. The vulnerability stems from insufficient input sanitization in the ORDER BY clause, enabling attackers to manipulate database queries. Public exploit code exists for this high-severity vulnerability, and patches are available in versions 4.16.18 and 5.8.22.
Craft CMS stores arbitrary content provided by unauthenticated users in session files. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 33.1%.
Craft CMS versions 3.x through 5.x contain a critical remote code execution vulnerability (CVSS 10.0) that allows unauthenticated attackers to execute arbitrary code on the server, actively exploited in the wild before patches were released.
Craft CMS 4 and 5 contain a remote code execution vulnerability exploitable when the application's security key has been compromised, allowing attackers with the key to execute arbitrary code on the server.
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Craft CMS is a platform for creating digital experiences. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Authenticated Craft CMS control-panel users holding viewEntries and viewPeerEntries (but not savePeerEntries) can silently reorder Matrix blocks and Addresses belonging to other authors' entries in Craft CMS 5.0.0 through 5.10.12 by POSTing directly to the actions/nested-elements/reorder endpoint. The flaw is a missing-authorization condition: the read-only entry view hands the session a manageNestedElements::<ownerId>::field:<handle> flag, and the reorder action trusts that flag without re-verifying the caller's save permission on the owner element, unlike the corresponding delete endpoint. Impact is limited to integrity of sort order (no read, creation, or deletion of content) and requires valid CP credentials plus a multi-author deployment with shared peer content, so it rates 5.3 (CVSS 4.0) and the low end of the integrity-only range; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). A vendor-released patch exists in 5.10.13.
Reflected XSS in Craft CMS versions before 5.9.7 and 4.17.3 allows remote attackers to execute arbitrary JavaScript in users' browsers via malicious return URLs that bypass insufficient sanitization. The vulnerability exists because the patch for a prior issue relied on strip_tags() to filter URLs, which fails to block dangerous URL schemes like javascript:. An attacker can craft a malicious link that, when clicked by an authenticated user, steals session cookies or performs actions on their behalf.
Unauthenticated attackers can generate preview tokens in Craft CMS versions prior to 4.17.4 and 5.9.7 by exploiting a CSRF vulnerability in the /actions/preview/create-token endpoint, which lacks proper token validation and HTTP method restrictions. An attacker can force a logged-in editor to create an attacker-controlled preview token that grants unauthorized access to unpublished content. This attack requires user interaction but allows the attacker to view sensitive content without authentication.
Unauthenticated attackers can trigger activation emails for pending user accounts in Craft CMS versions prior to 5.9.0-beta.2 and 4.17.0-beta.2 by exploiting an unprotected endpoint that lacks permission checks. If an attacker controls the target user's email address, they can complete account activation and gain unauthorized system access. A patch is available in the latest beta versions.
Craft CMS prior to versions 5.9.0-beta.1 and 4.17.0-beta.1 fails to properly authorize the "Duplicate" entry action, allowing authenticated users to bypass UI restrictions and duplicate entries via direct requests. An attacker with minimal "View Entries" permissions can exploit predictable, incremental Entry IDs to brute-force and duplicate other users' restricted content, gaining unauthorized access to sensitive data. Public exploit code exists for this vulnerability.
Craft CMS prior to versions 4.17.0-beta.1 and 5.9.0-beta.1 allows users with entry creation permissions to arbitrarily assign authorship of new entries to any user, including administrators, through mass assignment of the authorId parameter. Public exploit code exists for this vulnerability, enabling attackers to spoof entry authorship and manipulate content attribution. The vulnerability is fixed in the specified beta releases.
Craft CMS versions 4.5.0 through 4.16.18 and 5.0.0 through 5.8.22 contain an SSRF bypass in GraphQL Asset mutations where IPv6-only hostnames bypass the security blocklist, allowing authenticated users with GraphQL asset editing permissions to perform server-side request forgery attacks. Public exploit code exists for this vulnerability, which is a regression of a previously patched SSRF issue. Authenticated users with appropriate GraphQL schema permissions can exploit this to access internal resources or perform requests to arbitrary IPv6 addresses.
Multiple usage tokens in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 can be consumed beyond their intended limits due to a race condition in token validation logic where usage checks and database updates are not atomic. An authenticated attacker with access to a valid impersonation token can exploit concurrent requests to bypass usage restrictions and reuse single-use tokens multiple times. Patches are available for affected versions.
DNS rebinding attacks in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 allow authenticated attackers to bypass SSRF protections in GraphQL asset mutations by exploiting a Time-of-Check-Time-of-Use race condition between DNS validation and HTTP requests. Attackers with appropriate GraphQL schema permissions can access blocked IP addresses and internal resources that should be restricted. Public exploit code exists for this vulnerability, which represents a bypass of the previous CVE-2025-68437 fix.
Stored XSS in Craft CMS 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22 allows high-privileged administrators to inject malicious scripts into HTML-type table columns that execute in other users' browsers. Exploitation requires admin-level access and the `allowAdminChanges` setting enabled in production, limiting the risk to environments with already-compromised administrative accounts. Patches are available in versions 4.16.19 and 5.8.23.
Stored XSS in Craft CMS Number field settings (versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21) allows authenticated users with high privileges to inject malicious scripts via the Prefix or Suffix fields, which execute when the field is viewed on user profiles. Public exploit code exists for this vulnerability. Updates to versions 4.16.18 and 5.8.22 are available to remediate the issue.
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP addresses. [CVSS 6.5 MEDIUM]
SSRF bypass in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows unauthenticated attackers to access cloud metadata endpoints and internal IP addresses through the saveAsset GraphQL mutation by exploiting Guzzle's automatic redirect handling. The vulnerability bypasses hostname and IP blocklist protections that validate only the initial request URL, enabling attackers to reach sensitive internal resources. Public exploit code exists; patched versions 4.16.18 and 5.8.22 are available.
Craft CMS versions 3.5.0-4.16.17 and 5.0.0-RC1-5.8.21 contain a server-side request forgery vulnerability in the save_images_Asset GraphQL mutation that allows authenticated users to bypass hostname validation and retrieve internal URLs by specifying domains resolving to private IP addresses. By uploading files with non-image extensions like .txt, attackers can bypass downstream validation to access sensitive data including AWS instance metadata credentials from the host system. Public exploit code exists for this vulnerability, though patches are available in versions 4.16.18 and 5.8.22.
Stored cross-site scripting in Craft CMS versions 5.0.0-RC1 through 5.8.21 allows authenticated users with high privileges to inject malicious scripts through Entry Type names that are not sanitized when displayed in the Entry Types list. An attacker exploiting this vulnerability can execute arbitrary JavaScript in the browsers of other users viewing the affected list, potentially compromising session data or performing unauthorized actions. Public exploit code exists for this vulnerability, though a patch is available in version 5.8.22 and later.
Unauthenticated remote attackers can force a Craft CMS site to execute a database backup by sending a POST request to the updater/backup admin action, because all updater/* controller actions are configured with anonymous access. Affected installations are Craft CMS 5.0.0-RC1 through 5.8.20 and Craft CMS 3.0.0 through 4.16.16, where repeated unauthenticated calls can exhaust CPU, disk, and database resources, and may expose sensitive data if a generated backup file is separately reachable. Publicly available exploit code exists, though exploitation has not been confirmed as active by CISA KEV, and EPSS is low at 0.17 percent (37th percentile), consistent with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - a genuine but moderate-priority issue. Craft's patch short-circuits the action when no migrations are pending, which limits the impact on otherwise idle sites.
Authenticated remote code execution in Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 lets an attacker who already holds administrator access to the Craft Control Panel execute arbitrary PHP code on the server. The flaw is triggered by submitting a crafted Yii Behavior (yii\behaviors\AttributeTypecastBehavior) through field-layout body parameters (layoutConfig/config), abusing the 'as <behavior>' attachment syntax and a wildcard event binding so that any event fired on the tainted Component invokes an attacker-defined callable via reflection. Publicly available exploit code exists, and EPSS rates the issue at 1.12% (78th percentile), but there is no confirmed active exploitation (not in CISA KEV); the practical risk is heavily gated by the requirement for administrator privileges, so exposure is greatest where CP admin rights are delegated to lower-trust users or where admin sessions can be hijacked.
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. [CVSS 8.8 HIGH]
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). [CVSS 6.8 MEDIUM]
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. [CVSS 6.5 MEDIUM]
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 5.2), this vulnerability is remotely exploitable. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Craft is a content management system. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity.
Craft is a content management system (CMS). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a content management system (CMS). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a content management system (CMS). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft is a content management system. Rated medium severity (CVSS 5.4), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Craft is a CMS for creating custom digital experiences on the web and beyond. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS through 4.4.9 is vulnerable to HTML Injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Craft is a CMS for creating custom digital experiences on the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft is a CMS for creating custom digital experiences on the web. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS is an open source content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS is a content management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft is a platform for creating digital experiences. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Craft CMS before 3.7.29 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.7.14 allows CSV injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Craft CMS before 3.6.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
An issue was discovered in Craft CMS before 3.6.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS before 3.6.13 has an XSS vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.3.8 has stored XSS via a name field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.