Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-115934SQL injection leading to privilege escalation
- CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement
- CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle
- CVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration
- CVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg
- CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next
- CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field
- CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select
- CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass
- CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria
- CVE-2026-123488Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
- CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
- CVE-2026-115937Unauthenticated payment reuse allows unpaid orders to be marked as paid
- CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCE
- CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
- CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
- CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
- CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
- CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
- CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
- CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
- CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
- CVE-2026-109308Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
- CVE-2026-109307Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
- CVE-2026-109306Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
- CVE-2026-109305Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
- CVE-2026-109304Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
- CVE-2026-105985Authenticated RCE via render-components Entry Type overrides
- CVE-2026-92594Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
- CVE-2026-92593Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution