Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28783Craft has a Twig Function Blocklist Bypass
- CVE-2026-28782Craft has a Permission Bypass and IDOR in Duplicate Entry Action
- CVE-2026-28781Craft Affected by Entries Authorship Spoofing via Mass Assignment
- CVE-2026-28697Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- CVE-2026-28696Craft affected by IDOR via GraphQL @parseRefs
- CVE-2026-28695Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
- CVE-2026-27129Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- CVE-2026-27128Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
- CVE-2026-27127Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- CVE-2026-27126Craft CMS has Stored XSS in Table Field via "HTML" Column Type
- CVE-2026-25498Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2026-25497Craft has a GraphQL Asset Mutation Privilege Escalation
- CVE-2026-25496Craft has a stored XSS in Number Prefix & Suffix Fields
- CVE-2026-25495Craft has a SQL Injection in Element Indexes via criteria[orderBy]
- CVE-2026-25494Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation
- CVE-2026-25493Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
- CVE-2026-25492Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
- CVE-2026-25491Craft has a Stored XSS in Entry Types Name
- CVE-2020-37071CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution
- CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
- CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
- CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
- CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
- CVE-2026-25485Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25484Craft Commerce has Stored XSS in Product Type Name
- CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
- CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
- CVE-2025-68456Unauthenticated Craft CMS users can trigger a database backup