Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-72782Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
- CVE-2026-72781Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
- CVE-2026-72780Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
- CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
- CVE-2026-72778Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
- CVE-2026-50282Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
- CVE-2026-50281Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
- CVE-2026-50280Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
- CVE-2026-50279Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
- CVE-2026-55794Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
- CVE-2026-55792Craft CMS: Sensitive File Disclosure / Server-Side File Read
- CVE-2026-55791Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- CVE-2026-55790Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- CVE-2026-50284Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- CVE-2026-50283Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- CVE-2026-55793Craft CMS: Stored XSS via Structure entry title in table view
- CVE-2026-56394Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
- CVE-2026-56393Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
- CVE-2026-56385Craft CMS - Authorization Bypass in assets/preview-file Endpoint
- CVE-2026-56384Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
- CVE-2026-56383Craft CMS - Stored XSS in Table Field via Row Heading Column Type
- CVE-2026-56382Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController
- CVE-2026-56381Craft CMS - Stored XSS via User Group Name in User Permissions Page
- CVE-2026-44011Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2026-44012Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
- CVE-2026-44010Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- CVE-2026-41130Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- CVE-2026-41129Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations
- CVE-2026-41128Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
- CVE-2026-32272Craft Commerce: Blind SQL Injection via hasVariant/hasProduct