Craft CMS vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
153 matching records
- Low"app/icon-svg" reads arbitrary SVG content files from any path or aliasOpen the advisoryOct 23, 2026
- LowUnauthorized volume access through asset replacementOpen the advisoryOct 23, 2026
- MediumUnauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scopeOpen the advisoryOct 23, 2026
- MediumAnonymous GraphQL clients can read out-of-scope section contentOpen the advisoryOct 23, 2026
- MediumPublic registration inherits direct permissions from a deactivated accountOpen the advisoryOct 23, 2026
- HighLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEOpen the advisoryOct 23, 2026
- HighControl panel only API response emulation replaces "securityKey" and reaches server RCEOpen the advisoryOct 23, 2026
- High"app/render-elements" return URL signing oracle leads to RCEOpen the advisoryOct 23, 2026
- HighSQL injection leading to privilege escalationOpen the advisoryOct 22, 2026
- HighControl panel only blind SQL injection through "getNext"/"getPrev" criteriaOpen the advisoryOct 22, 2026
- HighControl panel only administrator privilege escalation through sandbox allowed "getOwners(criteria)"Open the advisoryOct 22, 2026
- HighUnauthenticated SQL injection via GraphQL eager-load "select" criteriaOpen the advisoryOct 22, 2026
- High8.7Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP…Check if you run itEPSS 0.61%Oct 19, 2026
- Critical9.3Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite()Check if you run itEPSS 0.39%Oct 19, 2026
- High8.7Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-…Check if you run itEPSS 0.64%Oct 19, 2026
- High8.7Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing u…Check if you run itEPSS 0.71%Oct 19, 2026
- High8.7Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::g…Check if you run itEPSS 0.71%Oct 19, 2026
- High7.1Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort…Check if you run itEPSS 0.32%Oct 19, 2026
- Medium6.0Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user c…Check if you run itEPSS 0.23%Oct 12, 2026
- High8.7Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.Check if you run itEPSS 0.48%Oct 12, 2026
- Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationCheck if you run itEPSS 0.18%Oct 12, 2026
- HighAuthenticated RCE via Twig group filter array-callableOpen the advisoryOct 5, 2026
- MediumTwig sandbox allowlist bypass discloses sensitive valuesOpen the advisoryOct 5, 2026
- HighAuthenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transformOpen the advisoryOct 5, 2026
- HighGHSA-wr79-9v6x-5rfq is listed by Authenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria.Open the advisoryOct 5, 2026