Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

Description The "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission where the "Duplicate" action is restricted in the UI, a user can bypass this restriction by sending a direc...

GHSA-5FVC-7894-GHP4 Craft CMS has Twig Function Blocklist Bypass

Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an...

Craft CMS has Twig Function Blocklist Bypass

Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either have allowAdminChanges enabled on production, or a compromised admin account, or an...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the authorId parameter during the entry creation. An attacker can assign authorship of new entries to...

Craft CMS: Entries Authorship Spoofing via Mass Assignment

Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign...

GHSA-2XFC-G69J-X2MP Craft CMS: Entries Authorship Spoofing via Mass Assignment

Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign...

GHSA-V47Q-JXVR-P68X Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

Summary An authenticated administrator can achieve Remote Code Execution RCE by injecting a Server-Side Template Injection SSTI payload into Twig template fields e.g., Email Templates. By calling the craft.app.fs.write method, an attacker can write a malicious PHP script to a web-accessible...

GHSA-4MGV-366X-QXVX Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

Overview of all XSS Reports Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows: | Report | What's Vulnerable | Why Separate | |--------|-------------------|--------------| | This Report 1 | Multiple settings names | Twig Template:...

Missing Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Missing Authorization via the parseRefs directive. An attacker can access sensitive attributes of any element, including user emails, usernames, custom fields, and internal server paths, by...

Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 patched in 5.8.7. Required Permissions - Administrator permissions or access...

GHSA-94RC-CQVM-M4PW Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 patched in 5.8.7. Required Permissions - Administrator permissions or access...

Cross-site Scripting (XSS)

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the wagtail.contrib.simpletranslation module. A user with access to the admin area can execute arbitrary JavaScript code in the context of...

CVE-2025-12462

A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind SQL Injection. This issue was fixed in versions above 8.0...

PT-2026-22996

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.0 Craft versions prior to 4.17.0 Description Craft is a content management system CMS. The system uses a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow function...

PT-2026-22948

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.0-beta.1 and versions prior to 5.9.0-beta.1 Description Craft is a content management system CMS that contains a flaw in the GraphQL directive @parseRefs. This directive, designed to parse internal reference tags,...

PT-2026-22947

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.8.21 Craft CMS versions prior to 4.17.0-beta.1 Craft CMS versions prior to 5.9.0-beta.1 Description Craft CMS contains an authenticated Remote Code Execution RCE issue. This occurs through Server-Side Template Injection...

PT-2026-22997

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.8.22 Craft versions prior to 4.16.18 Description Craft, a content management system CMS, is susceptible to Remote Code Execution RCE through a Server-Side Template Injection SSTI issue. A malicious payload can be...

PT-2026-22951

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.0-beta.1 Craft versions prior to 4.17.0-beta.1 Description Craft is a content management system CMS. A flaw exists where the "Duplicate" entry action does not properly verify user permissions for specific target...

PT-2026-22950

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.0-beta.1 Craft versions prior to 5.9.0-beta.1 Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorI...

PT-2026-25427

Overview of all XSS Reports Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows: | Report | What's Vulnerable | Why Separate | |--------|-------------------|--------------| | This Report 1 | Multiple settings names | Twig Template:...