# craftcms/cms (Packagist) vulnerabilities

132 known vulnerabilities (6 critical, 47 high, 51 medium, 5 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/craftcms/cms

## Advisories (132)

### [CVE-2026-79987](https://cve.now/CVE-2026-79987): Low-privilege RCE through element-search eager loading

- Severity: High 8.7
- Published: Sep 10, 2026
- Affected: from 5.8.0, fixed in 5.10.13.

### [CVE-2026-79991](https://cve.now/CVE-2026-79991): Authenticated SQL Injection via nested eager-loading criteria

- Severity: High 7.1
- Published: Sep 2, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.13.

### [CVE-2026-79990](https://cve.now/CVE-2026-79990): GQL entry mutation \`siteId\` bypasses schema site scope, enabling cross-site content read/write/delete

- Severity: High 8.7
- Published: Sep 2, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.11.

### [CVE-2026-79989](https://cve.now/CVE-2026-79989): Arbitrary user password reset leading to administrator account takeover

- Severity: High 8.7
- Published: Sep 2, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.8; from 5.0.0-RC1, fixed in 5.10.8.

### [CVE-2026-79988](https://cve.now/CVE-2026-79988): Authenticated RCE through Twig sandbox escape

- Severity: High 8.7
- Published: Aug 27, 2026
- Affected: from 4.0.0-RC1, fixed in 4.18.3; from 5.0.0-RC1, fixed in 5.10.7.

### [CVE-2026-78416](https://cve.now/CVE-2026-78416): Authenticated RCE via \`condition.config\` JSON cleanse bypass

- Severity: High 8.7
- Published: Aug 24, 2026
- Affected: from 4.0.0-RC1, fixed in 4.18.2; from 5.0.0-RC1, fixed in 5.10.6.

### [CVE-2026-72787](https://cve.now/CVE-2026-72787): Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

- Severity: Medium 5.1
- Published: Aug 12, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.8.

### [CVE-2026-72786](https://cve.now/CVE-2026-72786): Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset

- Severity: High 7.1
- Published: Aug 12, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.8.

### [CVE-2026-72785](https://cve.now/CVE-2026-72785): Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

- Severity: Critical 9.3
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.6.

### [CVE-2026-72783](https://cve.now/CVE-2026-72783): Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

- Severity: Medium 6.9
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.

### [CVE-2026-72782](https://cve.now/CVE-2026-72782): Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

- Severity: High 7.1
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.

### [CVE-2026-72781](https://cve.now/CVE-2026-72781): Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

- Severity: High 8.7
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.7; from 4.0.0-RC1, fixed in 4.18.3.

### [CVE-2026-72780](https://cve.now/CVE-2026-72780): Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey

- Severity: High 7.1
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.5.

### [CVE-2026-72779](https://cve.now/CVE-2026-72779): Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject

- Severity: High 8.7
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.

### [CVE-2026-72778](https://cve.now/CVE-2026-72778): Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

- Severity: High 8.7
- Published: Aug 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10.6; from 4.0.0-RC1, fixed in 4.18.2.

### [CVE-2026-14794](https://cve.now/CVE-2026-14794): Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

- Severity: Medium 5.3
- Published: Jul 6, 2026
- Affected: from 4.0.0-RC1, fixed in 4.18.1; from 5.0.0-RC1, fixed in 5.10.3.

### [CVE-2026-14793](https://cve.now/CVE-2026-14793): Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization

- Severity: Medium 5.3
- Published: Jul 6, 2026
- Affected: from 4.0.0-RC1, fixed in 4.18.1; from 5.0.0-RC1, fixed in 5.10.3.

### [CVE-2026-50282](https://cve.now/CVE-2026-50282): Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves

- Severity: Medium 4.9
- Published: Jul 2, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.21; from 4.0.0-RC1, fixed in 4.17.14.

### [CVE-2026-50281](https://cve.now/CVE-2026-50281): Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

- Severity: High 7.1
- Published: Jul 2, 2026
- Affected: from 5.7.0, fixed in 5.9.21.

### [CVE-2026-50280](https://cve.now/CVE-2026-50280): Craft CMS: Authorization bypass in \`entries/move-to-section\` via missing target-section save check

- Severity: Medium 6.0
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.21.

### [CVE-2026-50279](https://cve.now/CVE-2026-50279): Craft CMS: Authorship spoofing in \`entries/save-entry\` via pre-check/post-mutation authorization gap

- Severity: High 7.6
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.21.

### [CVE-2026-55794](https://cve.now/CVE-2026-55794): Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

- Severity: High 8.7
- Published: Jul 1, 2026
- Affected: from 5.9.0, fixed in 5.10.0.

### [CVE-2026-55792](https://cve.now/CVE-2026-55792): Craft CMS: Sensitive File Disclosure / Server-Side File Read

- Severity: Medium 6.0
- Published: Jul 1, 2026
- Affected: from 4.0.0-RC1, fixed in 4.18.0; from 5.0.0-RC1, fixed in 5.10.0.

### [CVE-2026-55791](https://cve.now/CVE-2026-55791): Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

- Severity: Medium 6.9
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.10; from 4.0.0-RC1, fixed in 4.18.

### [CVE-2026-55790](https://cve.now/CVE-2026-55790): Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

- Severity: High 7.4
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.23; from 4.0.0-RC1, fixed in 4.17.16.

### [CVE-2026-50284](https://cve.now/CVE-2026-50284): Craft CMS: Missing peer-permission check in \`AssetsController::actionDeleteFolder\` allows deletion of other users' assets

- Severity: High 7.1
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.22; from 4.0.0-RC1, fixed in 4.17.15.

### [CVE-2026-50283](https://cve.now/CVE-2026-50283): Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

- Severity: Medium 5.3
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.21; from 4.0.0-RC1, fixed in 4.17.14.

### [CVE-2026-55793](https://cve.now/CVE-2026-55793): Craft CMS: Stored XSS via Structure entry title in table view

- Severity: Medium 5.9
- Published: Jul 1, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.53.

### [CVE-2026-56394](https://cve.now/CVE-2026-56394): Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

- Severity: High 7.1
- Published: Jun 21, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.7; from 5.0.0-RC1, fixed in 5.9.13.

### [CVE-2026-56393](https://cve.now/CVE-2026-56393): Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options

- Severity: Medium 4.6
- Published: Jun 21, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-56385](https://cve.now/CVE-2026-56385): Craft CMS - Authorization Bypass in assets/preview-file Endpoint

- Severity: Medium 5.3
- Published: Jun 21, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.

### [CVE-2026-56384](https://cve.now/CVE-2026-56384): Craft CMS - Missing Authorization in assets/preview-thumb Endpoint

- Severity: Medium 5.3
- Published: Jun 21, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.8; from 5.0.0-RC1, fixed in 5.9.14.

### [CVE-2026-56383](https://cve.now/CVE-2026-56383): Craft CMS - Stored XSS in Table Field via Row Heading Column Type

- Severity: Medium 4.6
- Published: Jun 21, 2026
- Affected: from 4.5.0-beta.1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.

### [CVE-2026-56382](https://cve.now/CVE-2026-56382): Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController

- Severity: High 8.6
- Published: Jun 21, 2026
- Affected: from 5.5.0, fixed in 5.9.14.

### [CVE-2026-56381](https://cve.now/CVE-2026-56381): Craft CMS - Stored XSS via User Group Name in User Permissions Page

- Severity: Medium 4.6
- Published: Jun 21, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22.

### [CVE-2026-44011](https://cve.now/CVE-2026-44011): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

- Severity: High 8.6
- Published: May 12, 2026
- Affected: from 4.0.0, fixed in 4.17.12; from 5.0.0, fixed in 5.9.18.

### [CVE-2026-44012](https://cve.now/CVE-2026-44012): Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

- Severity: High 7.1
- Published: May 12, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.18.

### [CVE-2026-44010](https://cve.now/CVE-2026-44010): Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

- Severity: High 7.1
- Published: May 12, 2026
- Affected: from 5.0.0, fixed in 5.9.18; from 4.0.0, fixed in 4.17.12.

### [CVE-2026-41130](https://cve.now/CVE-2026-41130): Craft CMS has a host header injection leading to SSRF via resource-js endpoint

- Severity: Medium 5.5
- Published: Apr 21, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.15; from 4.0.0-RC1, fixed in 4.17.9.

### [CVE-2026-41129](https://cve.now/CVE-2026-41129): Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations

- Severity: Medium 5.5
- Published: Apr 21, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.15; from 4.0.0-RC1, fixed in 4.17.9.

### [CVE-2026-41128](https://cve.now/CVE-2026-41128): Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action

- Severity: Medium 5.3
- Published: Apr 21, 2026
- Affected: from 5.6.0, fixed in 5.9.15.

### [CVE-2026-33162](https://cve.now/CVE-2026-33162): Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions

- Severity: Medium 4.9
- Published: Mar 24, 2026
- Affected: from 5.3.0, fixed in 5.9.14.

### [CVE-2026-33161](https://cve.now/CVE-2026-33161): Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users

- Severity: Low 1.3
- Published: Mar 24, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.

### [CVE-2026-33160](https://cve.now/CVE-2026-33160): Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL

- Severity: Low 2.7
- Published: Mar 24, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.

### [CVE-2026-33159](https://cve.now/CVE-2026-33159): Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users

- Severity: Medium 6.9
- Published: Mar 24, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.14; from 4.0.0-RC1, fixed in 4.17.8.

### [CVE-2026-33158](https://cve.now/CVE-2026-33158): Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

- Severity: Medium 4.9
- Published: Mar 24, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.8; from 5.0.0-RC1, fixed in 5.9.14.

### [CVE-2026-33157](https://cve.now/CVE-2026-33157): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

- Severity: High 8.6
- Published: Mar 24, 2026
- Affected: from 5.6.0, fixed in 5.9.13.

### [CVE-2026-33051](https://cve.now/CVE-2026-33051): Craft CMS Vulnerable to Stored XSS in Revision Context Menu

- Severity: Medium 5.3
- Published: Mar 20, 2026
- Affected: from 5.9.0-beta.1, fixed in 5.9.11.

### [CVE-2026-32267](https://cve.now/CVE-2026-32267): Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController-\>actionImpersonateWithToken()

- Severity: High 7.7
- Published: Mar 16, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.6; from 5.0.0-RC1, fixed in 5.9.12.

### [CVE-2026-32264](https://cve.now/CVE-2026-32264): Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

- Severity: High 8.6
- Published: Mar 16, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.5; from 5.0.0-RC1, fixed in 5.9.11.

### [CVE-2026-32263](https://cve.now/CVE-2026-32263): Craft CMS vulnerable to behavior injection RCE via EntryTypesController

- Severity: High 8.6
- Published: Mar 16, 2026
- Affected: from 5.6.0, fixed in 5.9.11.

### [CVE-2026-32262](https://cve.now/CVE-2026-32262): Craft CMS has a Path Traversal Vulnerability in AssetsController

- Severity: Medium 5.3
- Published: Mar 16, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.5; from 5.0.0-RC1, fixed in 5.9.11.

### [CVE-2026-31859](https://cve.now/CVE-2026-31859): Craft has Reflective XSS via incomplete return URL sanitization

- Severity: Medium 6.9
- Published: Mar 11, 2026
- Affected: from 4.15.3, fixed in 4.17.3; from 5.7.5, fixed in 5.9.7.

### [CVE-2026-31858](https://cve.now/CVE-2026-31858): CraftCMS's \`ElementSearchController\` Affected by Blind SQL Injection

- Severity: High 8.7
- Published: Mar 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.9.

### [CVE-2026-31857](https://cve.now/CVE-2026-31857): CraftCMS has an RCE vulnerability via relational conditionals in the control panel

- Severity: High 8.1
- Published: Mar 11, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.9; from 4.0.0-beta.1, fixed in 4.17.4.

### [CVE-2026-29113](https://cve.now/CVE-2026-29113): Craft has a potential information disclosure vulnerability in preview tokens

- Severity: Low 2.3
- Published: Mar 10, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.3; from 5.0.0-RC1, fixed in 5.9.7.

### [CVE-2026-29069](https://cve.now/CVE-2026-29069): Craft has an unauthenticated activation email trigger with potential user enumeration

- Severity: Medium 6.9
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.2; from 4.0.0-RC1, fixed in 4.17.0-beta.2.

### [CVE-2026-28784](https://cve.now/CVE-2026-28784): Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

- Severity: High 8.6
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-28783](https://cve.now/CVE-2026-28783): Craft has a Twig Function Blocklist Bypass

- Severity: Critical 9.4
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-28782](https://cve.now/CVE-2026-28782): Craft has a Permission Bypass and IDOR in Duplicate Entry Action

- Severity: Medium 5.3
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-28781](https://cve.now/CVE-2026-28781): Craft Affected by Entries Authorship Spoofing via Mass Assignment

- Severity: High 7.1
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-28697](https://cve.now/CVE-2026-28697): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

- Severity: Critical 9.4
- Published: Mar 4, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-28696](https://cve.now/CVE-2026-28696): Craft affected by IDOR via GraphQL @parseRefs

- Severity: High 8.7
- Published: Mar 4, 2026
- Affected: from 4.0.0-RC1, fixed in 4.17.0-beta.1; from 5.0.0-RC1, fixed in 5.9.0-beta.1.

### [CVE-2026-28695](https://cve.now/CVE-2026-28695): Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

- Severity: High 7.5
- Published: Mar 4, 2026
- Affected: from 5.8.7, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-27129](https://cve.now/CVE-2026-27129): Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

- Severity: Medium 5.7
- Published: Feb 24, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.23; from 3.5.0, fixed in 4.16.19.

### [CVE-2026-27128](https://cve.now/CVE-2026-27128): Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit

- Severity: Medium 6.9
- Published: Feb 24, 2026
- Affected: from 4.5.0-RC1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.

### [CVE-2026-27127](https://cve.now/CVE-2026-27127): Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

- Severity: High 7.0
- Published: Feb 24, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.23; from 3.5.0, fixed in 4.16.19.

### [CVE-2026-27126](https://cve.now/CVE-2026-27126): Craft CMS has Stored XSS in Table Field via "HTML" Column Type

- Severity: Medium 5.9
- Published: Feb 24, 2026
- Affected: from 4.5.0-RC1, fixed in 4.16.19; from 5.0.0-RC1, fixed in 5.8.23.

### [CVE-2026-25498](https://cve.now/CVE-2026-25498): Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

- Severity: High 8.6
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.

### [CVE-2026-25497](https://cve.now/CVE-2026-25497): Craft has a GraphQL Asset Mutation Privilege Escalation

- Severity: High 8.6
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.9.0-beta.1; from 4.0.0-RC1, fixed in 4.17.0-beta.1.

### [CVE-2026-25496](https://cve.now/CVE-2026-25496): Craft has a stored XSS in Number Prefix & Suffix Fields

- Severity: Medium 4.8
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.

### [CVE-2026-25495](https://cve.now/CVE-2026-25495): Craft has a SQL Injection in Element Indexes via criteria\[orderBy\]

- Severity: High 8.7
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.

### [CVE-2026-25494](https://cve.now/CVE-2026-25494): Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation

- Severity: Medium 6.9
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.

### [CVE-2026-25493](https://cve.now/CVE-2026-25493): Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect

- Severity: Medium 6.9
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22; from 4.0.0-RC1, fixed in 4.16.18.

### [CVE-2026-25491](https://cve.now/CVE-2026-25491): Craft has a Stored XSS in Entry Types Name

- Severity: Low 1.9
- Published: Feb 9, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.22.

### [CVE-2025-68456](https://cve.now/CVE-2025-68456): Unauthenticated Craft CMS users can trigger a database backup

- Severity: High 7.0
- Published: Jan 5, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.21; from 3.0.0, fixed in 4.16.17.

### [CVE-2025-68455](https://cve.now/CVE-2025-68455): Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

- Severity: High 8.6
- Published: Jan 5, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.

### [CVE-2025-68454](https://cve.now/CVE-2025-68454): Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

- Severity: Medium 5.2
- Published: Jan 5, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.

### [CVE-2025-68437](https://cve.now/CVE-2025-68437): Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

- Severity: Medium 5.0
- Published: Jan 5, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.21; from 3.5.0, fixed in 4.16.17.

### [CVE-2025-68436](https://cve.now/CVE-2025-68436): Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

- Severity: Medium 4.9
- Published: Jan 5, 2026
- Affected: from 5.0.0-RC1, fixed in 5.8.21; from 4.0.0-RC1, fixed in 4.16.17.

### [CVE-2025-57811](https://cve.now/CVE-2025-57811): Craft Potential Remote Code Execution via Twig SSTI

- Severity: Medium 6.1
- Published: Aug 25, 2025
- Affected: from 4.0.0-RC1, fixed in 4.16.6; from 5.0.0-RC1, fixed in 5.8.7.

### [CVE-2025-54417](https://cve.now/CVE-2025-54417): Craft contains a theoretical bypass for CVE-2025-23209

- Severity: Medium 5.2
- Published: Aug 9, 2025
- Affected: from 4.13.8, fixed in 4.16.3; from 5.5.8, fixed in 5.8.4.

### [CVE-2025-35939](https://cve.now/CVE-2025-35939): Craft CMS stores user-provided content in session files

- Severity: Medium 5.3 · KEV
- Published: May 7, 2025
- Affected: from 5.0.0-alpha.1, fixed in 5.7.5; fixed in 4.15.3.

### [CVE-2025-46731](https://cve.now/CVE-2025-46731): Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

- Severity: High 7.3
- Published: May 5, 2025
- Affected: from 4.0.0-RC1, fixed in 4.14.13; from 5.0.0-RC1, fixed in 5.6.15.

### [CVE-2025-32432](https://cve.now/CVE-2025-32432): Craft CMS Allows Remote Code Execution

- Severity: Critical 10.0 · KEV
- Published: Apr 25, 2025
- Affected: from 3.0.0-RC1, fixed in 3.9.15; from 4.0.0-RC1, fixed in 4.14.15; from 5.0.0-RC1, fixed in 5.6.17.

### [CVE-2025-23209](https://cve.now/CVE-2025-23209): Potential RCE with a compromised security key in craft/cms

- Severity: High 8.1 · KEV
- Published: Jan 18, 2025
- Affected: from 5.0.0-RC1, fixed in 5.5.8; from 4.0.0-RC1, fixed in 4.13.8.

### [CVE-2024-56145](https://cve.now/CVE-2024-56145): RCE when PHP \`register\_argc\_argv\` config setting is enabled in craftcms/cms

- Severity: Critical 9.3 · KEV
- Published: Dec 18, 2024
- Affected: from 5.0.0-RC1, fixed in 5.5.2; from 4.0.0-RC1, fixed in 4.13.2; from 3.0.0, fixed in 3.9.14.

### [CVE-2024-52291](https://cve.now/CVE-2024-52291): Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

- Severity: High 8.5
- Published: Nov 13, 2024
- Affected: from 5.0.0-RC1, fixed in 5.4.6; from 4.0.0-RC1, fixed in 4.12.5.

### [CVE-2024-52292](https://cve.now/CVE-2024-52292): Craft Allows Attackers to Read Arbitrary System Files

- Severity: High 7.7
- Published: Nov 13, 2024
- Affected: from 5.0.0-alpha.1, fixed in 5.4.9; from 3.5.13, fixed in 4.12.8.

### [CVE-2024-52293](https://cve.now/CVE-2024-52293): Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

- Severity: High 7.2
- Published: Nov 13, 2024
- Affected: from 4.0.0-RC1, fixed in 4.12.2; from 5.0.0-RC1, fixed in 5.4.3.

### [CVE-2024-45406](https://cve.now/CVE-2024-45406): Craft CMS stored XSS in breadcrumb list and title fields

- Severity: Medium 5.5
- Published: Sep 9, 2024
- Affected: from 5.0.0, fixed in 5.1.2.

### [CVE-2024-41800](https://cve.now/CVE-2024-41800): Craft CMS Allows TOTP Token To Stay Valid After Use

- Severity: Medium 4.8
- Published: Jul 25, 2024
- Affected: from 5.0.0-beta.1, fixed in 5.2.3.

### [CVE-2024-37843](https://cve.now/CVE-2024-37843): Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

- Severity: High 7.5
- Published: Jun 25, 2024
- Affected: through 3.7.31.

### [CVE-2023-36260](https://cve.now/CVE-2023-36260): An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.

- Severity: Unrated
- Published: Jan 30, 2024
- Affected: fixed in 4.6.2.

### [CVE-2024-21622](https://cve.now/CVE-2024-21622): Craft CMS Privilege Escalation

- Severity: Medium 5.4
- Published: Jan 3, 2024
- Affected: from 4.0.0-RC1, fixed in 4.5.11; from 3.0.0, fixed in 3.9.6.

### [CVE-2023-41892](https://cve.now/CVE-2023-41892): Craft CMS Remote Code Execution vulnerability

- Severity: Critical 10.0
- Published: Sep 13, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.15.

### [CVE-2023-40035](https://cve.now/CVE-2023-40035): Craft CMS vulnerable to Remote Code Execution via validatePath bypass

- Severity: High 7.2
- Published: Aug 23, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.15; from 3.0.0, fixed in 3.8.15.

### [CVE-2023-33495](https://cve.now/CVE-2023-33495): Craft CMS through 4.4.9 is vulnerable to HTML Injection.

- Severity: Medium 6.1
- Published: Jun 20, 2023
- Affected: through 4.4.9.

### [CVE-2023-33195](https://cve.now/CVE-2023-33195): Craft CMS XSS in RSS widget feed

- Severity: Medium 5.0
- Published: May 27, 2023
- Affected: from 4.3.0, fixed in 4.4.6.

### [CVE-2023-33194](https://cve.now/CVE-2023-33194): CraftCMS stored XSS in Quick Post widget error message

- Severity: Low 3.7
- Published: May 26, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.6; from 3.0.0, fixed in 3.8.6.

### [CVE-2023-33196](https://cve.now/CVE-2023-33196): Craft CMS stored XSS in review volume

- Severity: Medium 5.5
- Published: May 26, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.7.

### [CVE-2023-33197](https://cve.now/CVE-2023-33197): Craft CMS stored XSS in indexedVolumes

- Severity: Medium 5.5
- Published: May 26, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.6.

### [CVE-2023-2817](https://cve.now/CVE-2023-2817): A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions \<= 4.4.11.

- Severity: Medium 5.4
- Published: May 26, 2023
- Affected: from 4.0.0-RC1, fixed in 4.4.12.

### [CVE-2023-32679](https://cve.now/CVE-2023-32679): Remote Code Execution via unrestricted file extension in Craft CMS

- Severity: High 7.2
- Published: May 19, 2023
- Affected: from 4.0.0, fixed in 4.4.6.

### [CVE-2023-30130](https://cve.now/CVE-2023-30130): An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

- Severity: High 8.8
- Published: May 12, 2023
- Affected: through 3.8.1.

### [CVE-2023-31144](https://cve.now/CVE-2023-31144): Craft CMS vulnerable to cross site scripting in RSS feed widget

- Severity: Medium 6.1
- Published: May 9, 2023
- Affected: from 3.0.0, fixed in 3.8.4; from 4.0.0, fixed in 4.4.4.

### [CVE-2023-30177](https://cve.now/CVE-2023-30177): CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).

- Severity: Medium 6.1
- Published: Apr 25, 2023
- Affected: fixed in 3.7.68.

### [CVE-2023-23927](https://cve.now/CVE-2023-23927): Craft CMS stored cross-site scripting vulnerability

- Severity: Medium 6.1
- Published: Mar 3, 2023
- Affected: from 4.0.0-RC1, fixed in 4.3.7; from 3.7.24, fixed in 3.7.64.

### [CVE-2022-37783](https://cve.now/CVE-2022-37783): All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username…

- Severity: Unrated
- Published: Dec 5, 2022
- Affected: from 3.0.0, fixed in 3.7.33.

### [CVE-2022-37246](https://cve.now/CVE-2022-37246): Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific…

- Severity: Medium 5.4
- Published: Sep 21, 2022
- Affected: from 4.0.0-RC1, fixed in 4.2.1; from 3.7.39, fixed in 3.7.51.

### [CVE-2022-37251](https://cve.now/CVE-2022-37251): Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts.

- Severity: Unrated
- Published: Sep 16, 2022
- Affected: from 3.7.0-beta.1, fixed in 3.7.55.2; from 4.0.0-RC1, fixed in 4.2.1.

### [CVE-2022-37247](https://cve.now/CVE-2022-37247): Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.

- Severity: Unrated
- Published: Sep 16, 2022
- Affected: from 4.0.0-RC1, fixed in 4.2.1.

### [CVE-2022-37248](https://cve.now/CVE-2022-37248): Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.

- Severity: Unrated
- Published: Sep 16, 2022
- Affected: from 4.0.0-RC1, fixed in 4.2.1.

### [CVE-2022-37250](https://cve.now/CVE-2022-37250): Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.

- Severity: Medium 5.4
- Published: Sep 16, 2022
- Affected: from 4.0.0-RC1, fixed in 4.2.1.

### [CVE-2022-29933](https://cve.now/CVE-2022-29933): Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password…

- Severity: Unrated
- Published: May 9, 2022
- Affected: fixed in 3.7.36.

### [CVE-2022-28378](https://cve.now/CVE-2022-28378): Craft CMS before 3.7.29 allows XSS.

- Severity: Unrated
- Published: Apr 3, 2022
- Affected: fixed in 3.7.29.

### [CVE-2021-41824](https://cve.now/CVE-2021-41824): Craft CMS before 3.7.14 allows CSV injection.

- Severity: Unrated
- Published: Sep 29, 2021
- Affected: from 3.4.0, fixed in 3.7.14.

### [CVE-2021-27903](https://cve.now/CVE-2021-27903): An issue was discovered in Craft CMS before 3.6.7.

- Severity: Unrated
- Published: Jun 30, 2021
- Affected: fixed in 3.6.7.

### [CVE-2021-27902](https://cve.now/CVE-2021-27902): An issue was discovered in Craft CMS before 3.6.0.

- Severity: Unrated
- Published: Jun 30, 2021
- Affected: fixed in 3.6.0.

### [CVE-2021-32470](https://cve.now/CVE-2021-32470): Craft CMS before 3.6.13 has an XSS vulnerability.

- Severity: Unrated
- Published: May 7, 2021
- Affected: fixed in 3.6.13.

### [CVE-2020-19626](https://cve.now/CVE-2020-19626): Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via…

- Severity: Unrated
- Published: Mar 26, 2021
- Affected: fixed in 3.1.33.

### [CVE-2019-15929](https://cve.now/CVE-2019-15929): In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the…

- Severity: Unrated
- Published: Oct 24, 2019
- Affected: fixed in 3.1.7.

### [CVE-2019-17496](https://cve.now/CVE-2019-17496): Craft CMS before 3.3.8 has stored XSS via a name field.

- Severity: Unrated
- Published: Oct 10, 2019
- Affected: fixed in 3.3.8.

### [CVE-2019-12823](https://cve.now/CVE-2019-12823): Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.

- Severity: Unrated
- Published: Jun 18, 2019
- Affected: fixed in 3.1.31.

### [CVE-2018-20465](https://cve.now/CVE-2018-20465): Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as…

- Severity: Unrated
- Published: Dec 25, 2018
- Affected: through 3.0.34.

### [CVE-2018-20418](https://cve.now/CVE-2018-20418): index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

- Severity: Unrated
- Published: Dec 24, 2018
- Affected: through 3.0.25.

### [CVE-2018-3814](https://cve.now/CVE-2018-3814): Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-\>Upload files" screen and then the "Replace…

- Severity: Unrated
- Published: Jan 1, 2018
- Affected: through 2.6.3000.

### [CVE-2017-9516](https://cve.now/CVE-2017-9516): Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

- Severity: Unrated
- Published: Jun 8, 2017
- Affected: fixed in 2.6.2982.

### [CVE-2017-8385](https://cve.now/CVE-2017-8385): Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

- Severity: Unrated
- Published: May 1, 2017
- Affected: fixed in 2.6.2976.

### [CVE-2017-8384](https://cve.now/CVE-2017-8384): Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need…

- Severity: Unrated
- Published: May 1, 2017
- Affected: fixed in 2.6.2976.

### [CVE-2017-8383](https://cve.now/CVE-2017-8383): Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.

- Severity: Unrated
- Published: May 1, 2017
- Affected: fixed in 2.6.2976.

### [CVE-2017-8052](https://cve.now/CVE-2017-8052): Craft CMS before 2.6.2974 allows XSS attacks.

- Severity: Unrated
- Published: Apr 22, 2017
- Affected: fixed in 2.6.2974.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/craftcms/cms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.