PT-2026-80152

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p8+tuxcare...

Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal in the ensurePathIsContained function. An attacker can potentially access files outside the intended directory by manipulating file paths during the normalization process...

Protection Mechanism Failure

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...

PT-2026-70200

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description Authenticated users with control panel access can leak arbitrary environment variables and secrets. This occurs because the software interpolat...

Exploit for Code Injection in Craftcms Craft_Cms

bash payload=$printf %s "bash -c...

CLSA-2026-1784077481 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

CLSA-2026-1783386121 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

CLSA-2026-1774313530 TuxCare security update for craftcms/cms (10 CVEs)

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

CLSA-2026-1776904647 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-75317

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

PT-2026-75422

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

PT-2026-75378

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p5+tuxcare...

PT-2026-74105

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

PT-2026-74443

TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 3.9.15-p2+tuxcare...

PT-2026-74562

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-75570

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare...

CraftCMS Debug Methods Exposed Detection

Detected CraftCMS with devMode enabled, which exposed the Yii2 debug toolbar and sensitive information. This misconfiguration could have leaked database queries, session data, cookies, stack traces, CSRF tokens, and internal application details to unauthenticated users. !/usr/bin/env python3 --...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the actionRenderCardPreview process. An attacker can execute arbitrary PHP code and disclose sensitive information by injecting malicious event handlers into the...

Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal via the actionIcon process. An attacker can access arbitrary local .svg files by supplying crafted traversal sequences in the extension parameter, allowing disclosure of...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the renderObjectTemplate process. An attacker can execute arbitrary code by supplying malicious input in the HTTP Referer header when saving entries in the control...