CVE-2018-18307

AlchemyCMS 4.1.0 is vulnerable to a Stored XSS via the /admin/pictures image field. The issue is caused by improper handling of user input in that field (SNYK cites improper input sanitization). The vendor disputes the report, stating the request relied on an authorized session cookie; without it...

CVE-2026-23885

CVE-2026-23885 – AlchemyCMS RCE via eval in ResourcesHelper . The vulnerability affects AlchemyCMS (Ruby on Rails) prior to 7.4.12 and 8.0.3, where the code in Alchemy::ResourcesHelper#resource_url_proxy uses Ruby’s eval() on the value of resource_handler.engine_name. This string is sourced from ...