Craftcms vulnerabilities
175 CVEs and advisories name Craftcms as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2025-68454Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- CVE-2025-68437Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- CVE-2025-68436Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
- CVE-2025-57811Craft Potential Remote Code Execution via Twig SSTI
- CVE-2025-54417Craft contains a theoretical bypass for CVE-2025-23209
- CVE-2025-46731Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
- CVE-2025-32432Craft CMS Allows Remote Code Execution
- CVE-2025-23209Potential RCE with a compromised security key in craft/cms
- CVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
- CVE-2024-52291Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
- CVE-2024-52292Craft Allows Attackers to Read Arbitrary System Files
- CVE-2024-52293Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
- CVE-2024-45406Craft CMS stored XSS in breadcrumb list and title fields
- CVE-2024-41800Craft CMS Allows TOTP Token To Stay Valid After Use
- CVE-2024-21622Craft CMS Privilege Escalation
- CVE-2023-41892Craft CMS Remote Code Execution vulnerability
- CVE-2023-40035Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- CVE-2023-33195Craft CMS XSS in RSS widget feed
- CVE-2023-33194CraftCMS stored XSS in Quick Post widget error message
- CVE-2023-33196Craft CMS stored XSS in review volume
- CVE-2023-33197Craft CMS stored XSS in indexedVolumes
- CVE-2023-32679Remote Code Execution via unrestricted file extension in Craft CMS
- CVE-2023-31144Craft CMS vulnerable to cross site scripting in RSS feed widget
- CVE-2023-23927Craft CMS stored cross-site scripting vulnerability