porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories  /  composer  /  craftcms

composer

craftcms/cms

Security advisories for craftcms/cms, newest first. 128 known, 58 without a fix yet.

RSS feed Check your lock file →

Latest version

5.11.5.1

Advisories

128 · 58 unfixed

Last advisory

7 Aug 2026

Safe from

no fix for all yet

128 advisories · newest first

CRITICAL 7 Aug 2026

Craft CMS: Passkey login accepts replayed WebAuthn assertions

GHSA-wg23-69c2-gjc8

Affected

≥ 5.0.0-RC1, < 5.10.5

Fixed in

5.10.5
MODERATE 6 Aug 2026

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

GHSA-957r-qf9p-67xw · CVE-2026-72779

Affected

≥ 4.0.0-RC1, < 4.18.2 ≥ 5.0.0-RC1, < 5.10.6

Fixed in

4.18.2 5.10.6
MODERATE 6 Aug 2026

Craft CMS: Authenticated leak of secret environment variables

GHSA-596p-6jv8-775v · CVE-2026-72782

Affected

≥ 4.0.0-RC1, < 4.18.2 ≥ 5.0.0-RC1, < 5.10.6

Fixed in

4.18.2 5.10.6
MODERATE 6 Aug 2026

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

GHSA-xxpx-f366-4xpq · CVE-2026-72785

Affected

≥ 5.0.0-RC1, < 5.10.6

Fixed in

5.10.6
MODERATE4.3 6 Aug 2026

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

GHSA-rvmm-v933-jgxq · CVE-2026-14794

Affected

≥ 4.0.0-RC1, < 4.18.1 ≥ 5.0.0-RC1, < 5.10.3

Fixed in

4.18.1 5.10.3
LOW 6 Aug 2026

Craft CMS: Incorrect path validation could potentially lead to path traversal

GHSA-7hxc-f267-h5q7 · CVE-2026-72783

Affected

≥ 4.0.0-RC1, < 4.18.2 ≥ 5.0.0-RC1, < 5.10.6

Fixed in

4.18.2 5.10.6
MODERATE 6 Aug 2026

Craft CMS: Stored XSS in the control panel via unescaped draft name

GHSA-2rp4-x2j7-qmcc

Affected

≥ 5.0.0-RC1, < 5.10.8

Fixed in

5.10.8
HIGH 6 Aug 2026

Craft CMS: Arbitrary user password reset leading to administrator account takeover

GHSA-p8x7-9vfw-p7vc

Affected

≥ 5.0.0-RC1, < 5.10.8

Fixed in

5.10.8
HIGH 6 Aug 2026

Craft CMS: Authenticated RCE through Twig sandbox escape

GHSA-f5wm-88jv-g5hx · CVE-2026-72781

Affected

≥ 4.0.0-RC1, < 4.18.3 ≥ 5.0.0-RC1, < 5.10.7

Fixed in

4.18.3 5.10.7
MODERATE4.3 6 Aug 2026

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

GHSA-9p7c-v5x3-rfx8 · CVE-2026-14793

Affected

≥ 4.0.0-RC1, < 4.18.1 ≥ 5.0.0-RC1, < 5.10.3

Fixed in

4.18.1 5.10.3
HIGH 6 Aug 2026

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

GHSA-265m-7826-wjqm · CVE-2026-72778

Affected

≥ 4.0.0-RC1, < 4.18.2 ≥ 5.0.0-RC1, < 5.10.6

Fixed in

4.18.2 5.10.6
HIGH 9 Jul 2026

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

GHSA-86vw-x4ww-x467 · CVE-2026-56382

Affected

≥ 5.5.0, ≤ 5.9.13

Fixed in

no fix yet
LOW 9 Jul 2026

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

GHSA-c43v-4cr8-6mvp · CVE-2026-56394

Affected

≥ 4.0.0-RC1, ≤ 4.17.6 ≥ 5.0.0-RC1, ≤ 5.9.12

Fixed in

no fix yet
HIGH 6 Jul 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

GHSA-f74w-488g-8x5r · CVE-2026-55794

Affected

≥ 5.9.0, < 5.10.0

Fixed in

5.10.0
MODERATE 6 Jul 2026

Craft CMS: Stored XSS via Structure entry title in table view

GHSA-xrqc-p465-2xvg · CVE-2026-55793

Affected

≥ 5.0.0-RC1, < 5.9.22

Fixed in

5.9.22
MODERATE 6 Jul 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

GHSA-287w-mxq6-x2cp · CVE-2026-55792

Affected

≥ 4.0.0-RC1, < 4.18.0 ≥ 5.0.0-RC1, < 5.10.0

Fixed in

4.18.0 5.10.0
HIGH 6 Jul 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

GHSA-24x4-j6x9-rfw5 · CVE-2026-55790

Affected

≥ 4.0.0-RC1, < 4.17.15 ≥ 5.0.0-RC1, < 5.9.22

Fixed in

4.17.15 5.9.22
MODERATE 6 Jul 2026

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

GHSA-x76w-8c62-48mg · CVE-2026-56384

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
HIGH 2 Jul 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

GHSA-3w32-23wj-rxg3 · CVE-2026-50282

Affected

≥ 4.0.0-RC1, < 4.17.14 ≥ 5.0.0-RC1, < 5.9.21

Fixed in

4.17.14 5.9.21
HIGH 2 Jul 2026

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

GHSA-x5m4-g2cq-52pq · CVE-2026-50281

Affected

≥ 5.7.0, < 5.9.21

Fixed in

5.9.21
HIGH 2 Jul 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

GHSA-7h62-6v23-v8fm · CVE-2026-50284

Affected

≥ 4.0.0-RC1, < 4.17.15 ≥ 5.0.0-RC1, < 5.9.22

Fixed in

4.17.15 5.9.22
MODERATE 2 Jul 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

GHSA-qh45-9g5p-m2v4 · CVE-2026-50283

Affected

≥ 4.0.0-RC1, < 4.17.14 ≥ 5.0.0-RC1, < 5.9.21

Fixed in

4.17.14 5.9.21
MODERATE 2 Jul 2026

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

GHSA-43cq-c2gq-pfpw · CVE-2026-50280

Affected

≥ 5.0.0-RC1, < 5.9.21

Fixed in

5.9.21
HIGH 2 Jul 2026

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

GHSA-qq2c-2q8j-jh27 · CVE-2026-50279

Affected

≥ 5.0.0-RC1, < 5.9.21

Fixed in

5.9.21
CRITICAL 19 Jun 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

GHSA-c55v-343g-5xff · CVE-2026-55791

Affected

≥ 4.0.0-RC1, < 4.18 ≥ 5.0.0-RC1, < 5.10

Fixed in

4.18 5.10
HIGH 6 May 2026

Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

GHSA-33m5-hqp9-97pw · CVE-2026-44012

Affected

≥ 5.0.0-RC1, < 5.9.18

Fixed in

5.9.18
HIGH 6 May 2026

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

GHSA-qrgm-p9w5-rrfw · CVE-2026-44011

Affected

≥ 4.0.0, < 4.17.12 ≥ 5.0.0, < 5.9.18

Fixed in

4.17.12 5.9.18
HIGH 6 May 2026

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

GHSA-gj2p-p9m4-c8gw · CVE-2026-44010

Affected

≥ 4.0.0, < 4.17.12 ≥ 5.0.0, < 5.9.18

Fixed in

4.17.12 5.9.18
MODERATE 14 Apr 2026

Craft CMS has a host header injection leading to SSRF via resource-js endpoint

GHSA-95wr-3f2v-v2wh · CVE-2026-41130

Affected

≥ 4.0.0-RC1, ≤ 4.17.8 ≥ 5.0.0-RC1, ≤ 5.9.14

Fixed in

no fix yet
MODERATE 14 Apr 2026

Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

GHSA-3m9m-24vh-39wx · CVE-2026-41129

Affected

≥ 4.0.0-RC1, ≤ 4.17.8 ≥ 5.0.0-RC1, ≤ 5.9.14

Fixed in

no fix yet
MODERATE 14 Apr 2026

Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action

GHSA-jq2f-59pj-p3m3 · CVE-2026-41128

Affected

≥ 5.6.0, < 5.9.15

Fixed in

5.9.15
LOW 26 Mar 2026

Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

GHSA-44px-qjjc-xrhq · CVE-2026-56385

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
MODERATE 24 Mar 2026

Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

GHSA-f582-6gf6-gx4g · CVE-2026-33162

Affected

≥ 5.3.0, ≤ 5.9.13

Fixed in

no fix yet
LOW 24 Mar 2026

Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

GHSA-vgjg-248p-rfm2 · CVE-2026-33161

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
LOW 24 Mar 2026

Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

GHSA-5pgf-h923-m958 · CVE-2026-33160

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
MODERATE 24 Mar 2026

Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

GHSA-6mrr-q3pj-h53w · CVE-2026-33159

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
MODERATE 24 Mar 2026

Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

GHSA-3pvf-vxrv-hh9c · CVE-2026-33158

Affected

≥ 4.0.0-RC1, ≤ 4.17.7 ≥ 5.0.0-RC1, ≤ 5.9.13

Fixed in

no fix yet
HIGH 24 Mar 2026

Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior

GHSA-2fph-6v5w-89hh · CVE-2026-33157

Affected

≥ 5.6.0, ≤ 5.9.12

Fixed in

no fix yet
MODERATE 18 Mar 2026

Craft CMS Vulnerable to Stored XSS in Revision Context Menu

GHSA-3x4w-mxpf-fhqq · CVE-2026-33051

Affected

≥ 5.9.0-beta.1, ≤ 5.9.10

Fixed in

no fix yet
HIGH 16 Mar 2026

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

GHSA-cc7p-2j3x-x7xf · CVE-2026-32267

Affected

≥ 4.0.0-RC1, ≤ 4.17.5 ≥ 5.0.0-RC1, ≤ 5.9.11

Fixed in

no fix yet
HIGH 16 Mar 2026

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

GHSA-4484-8v2f-5748 · CVE-2026-32264

Affected

≥ 4.0.0-RC1, ≤ 4.17.4 ≥ 5.0.0-RC1, ≤ 5.9.10

Fixed in

no fix yet
HIGH 16 Mar 2026

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

GHSA-qx2q-q59v-wf3j · CVE-2026-32263

Affected

≥ 5.6.0, ≤ 5.9.10

Fixed in

no fix yet
MODERATE 16 Mar 2026

Craft CMS has a Path Traversal Vulnerability in AssetsController

GHSA-472v-j2g4-g9h2 · CVE-2026-32262

Affected

≥ 4.0.0-RC1, ≤ 4.17.4 ≥ 5.0.0-RC1, ≤ 5.9.10

Fixed in

no fix yet
LOW 11 Mar 2026

Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page

GHSA-g3hp-vvqf-8vw6 · CVE-2026-56381

Affected

≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
HIGH 11 Mar 2026

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

GHSA-fp5j-j7j4-mcxc · CVE-2026-31857

Affected

≥ 4.0.0-beta.1, ≤ 4.17.3 ≥ 5.0.0-RC1, ≤ 5.9.8

Fixed in

no fix yet
HIGH 11 Mar 2026

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

GHSA-g7j6-fmwx-7vp8 · CVE-2026-31858

Affected

≥ 5.0.0-RC1, ≤ 5.9.8

Fixed in

no fix yet
MODERATE 11 Mar 2026

CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization

GHSA-fvwq-45qv-xvhv · CVE-2026-31859

Affected

≥ 4.15.3, ≤ 4.17.2 ≥ 5.7.5, ≤ 5.9.6

Fixed in

no fix yet
LOW 10 Mar 2026

Craft CMS has a potential information disclosure vulnerability in preview tokens

GHSA-vg3j-hpm9-8v5v · CVE-2026-29113

Affected

≥ 4.0.0-RC1, < 4.17.3 ≥ 5.0.0-RC1, < 5.9.7

Fixed in

4.17.3 5.9.7
HIGH 4 Mar 2026

Craft CMS has unauthenticated activation email trigger with potential user enumeration

GHSA-234q-vvw3-mrfq · CVE-2026-29069

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.2 ≥ 5.0.0-RC1, < 5.9.0-beta.2

Fixed in

4.17.0-beta.2 5.9.0-beta.2
MODERATE 3 Mar 2026

Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

GHSA-qc86-q28f-ggww · CVE-2026-28784

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
MODERATE 3 Mar 2026

Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

GHSA-jxm3-pmm2-9gf6 · CVE-2026-28782

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
MODERATE 3 Mar 2026

Craft CMS has Twig Function Blocklist Bypass

GHSA-5fvc-7894-ghp4 · CVE-2026-28783

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
MODERATE 3 Mar 2026

Craft CMS: Entries Authorship Spoofing via Mass Assignment

GHSA-2xfc-g69j-x2mp · CVE-2026-28781

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
CRITICAL 3 Mar 2026

Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

GHSA-v47q-jxvr-p68x · CVE-2026-28697

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
LOW 3 Mar 2026

Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

GHSA-4mgv-366x-qxvx · CVE-2026-56393

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
HIGH 3 Mar 2026

Craft CMS has IDOR via GraphQL @parseRefs

GHSA-7x43-mpfg-r9wj · CVE-2026-28696

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
MODERATE 3 Mar 2026

Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

GHSA-94rc-cqvm-m4pw · CVE-2026-28695

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.8.7, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
LOW 25 Feb 2026

Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

GHSA-6j87-m5qx-9fqp · CVE-2026-56383

Affected

≥ 4.5.0-beta.1, ≤ 4.16.18 ≥ 5.0.0-RC1, ≤ 5.8.22

Fixed in

no fix yet
MODERATE 24 Feb 2026

Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution

GHSA-v2gc-rm6g-wrw9 · CVE-2026-27129

Affected

≥ 3.5.0, ≤ 4.16.18 ≥ 5.0.0-RC1, ≤ 5.8.22

Fixed in

no fix yet
MODERATE 23 Feb 2026

Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit

GHSA-6fx5-5cw5-4897 · CVE-2026-27128

Affected

≥ 4.5.0-RC1, ≤ 4.16.18 ≥ 5.0.0-RC1, ≤ 5.8.22

Fixed in

no fix yet
HIGH 23 Feb 2026

Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

GHSA-gp2f-7wcm-5fhx · CVE-2026-27127

Affected

≥ 3.5.0, ≤ 4.16.18 ≥ 5.0.0-RC1, ≤ 5.8.22

Fixed in

no fix yet
MODERATE 23 Feb 2026

Craft CMS has Stored XSS in Table Field via "HTML" Column Type

GHSA-3jh3-prx3-w6wc · CVE-2026-27126

Affected

≥ 4.5.0-RC1, ≤ 4.16.18 ≥ 5.0.0-RC1, ≤ 5.8.22

Fixed in

no fix yet
HIGH 9 Feb 2026

Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

GHSA-7jx7-3846-m7w7 · CVE-2026-25498

Affected

≥ 4.0.0-RC1, ≤ 4.16.17 ≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
HIGH 9 Feb 2026

Craft CMS: GraphQL Asset Mutation Privilege Escalation

GHSA-fxp3-g6gw-4r4v · CVE-2026-25497

Affected

≥ 4.0.0-RC1, < 4.17.0-beta.1 ≥ 5.0.0-RC1, < 5.9.0-beta.1

Fixed in

4.17.0-beta.1 5.9.0-beta.1
MODERATE 9 Feb 2026

Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

GHSA-9f5h-mmq6-2x78 · CVE-2026-25496

Affected

≥ 4.0.0-RC1, ≤ 4.16.17 ≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
HIGH 9 Feb 2026

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

GHSA-2453-mppf-46cj · CVE-2026-25495

Affected

≥ 4.0.0-RC1, ≤ 4.16.17 ≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
MODERATE 9 Feb 2026

Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

GHSA-m5r2-8p9x-hp5m · CVE-2026-25494

Affected

≥ 4.0.0-RC1, ≤ 4.16.17 ≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
MODERATE 9 Feb 2026

Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

GHSA-8jr8-7hr4-vhfx · CVE-2026-25493

Affected

≥ 4.0.0-RC1, ≤ 4.16.17 ≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
LOW 9 Feb 2026

Craft CMS Vulnerable to Stored XSS in Entry Types Name

GHSA-7pr4-wx9w-mqwr · CVE-2026-25491

Affected

≥ 5.0.0-RC1, ≤ 5.8.21

Fixed in

no fix yet
HIGH 5 Jan 2026

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

GHSA-255j-qw47-wjh5 · CVE-2025-68455

Affected

≥ 4.0.0-RC1, ≤ 4.16.16 ≥ 5.0.0-RC1, ≤ 5.8.20

Fixed in

no fix yet
HIGH 5 Jan 2026

Unauthenticated Craft CMS users can trigger a database backup

GHSA-v64r-7wg9-23pr · CVE-2025-68456

Affected

≥ 3.0.0, ≤ 4.16.16 ≥ 5.0.0-RC1, ≤ 5.8.20

Fixed in

no fix yet
MODERATE 5 Jan 2026

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

GHSA-742x-x762-7383 · CVE-2025-68454

Affected

≥ 4.0.0-RC1, ≤ 4.16.16 ≥ 5.0.0-RC1, ≤ 5.8.20

Fixed in

no fix yet
MODERATE 5 Jan 2026

Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

GHSA-x27p-wfqw-hfcc · CVE-2025-68437

Affected

≥ 3.5.0, ≤ 4.16.16 ≥ 5.0.0-RC1, ≤ 5.8.20

Fixed in

no fix yet
MODERATE 5 Jan 2026

Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

GHSA-53vf-c43h-j2x9 · CVE-2025-68436

Affected

≥ 4.0.0-RC1, ≤ 4.16.16 ≥ 5.0.0-RC1, ≤ 5.8.20

Fixed in

no fix yet
MODERATE 25 Aug 2025

Craft CMS Potential Remote Code Execution via Twig SSTI

GHSA-crcq-738g-pqvc · CVE-2025-57811

Affected

≥ 4.0.0-RC1, ≤ 4.16.5 ≥ 5.0.0-RC1, ≤ 5.8.6

Fixed in

no fix yet
MODERATE 8 Aug 2025

Craft CMS has a theoretical bypass for CVE-2025-23209

GHSA-2vcf-qxv3-2mgw · CVE-2025-54417

Affected

≥ 4.13.8, < 4.16.3 ≥ 5.5.8, < 5.8.4

Fixed in

4.16.3 5.8.4
MODERATE5.3 8 May 2025

Craft CMS stores arbitrary content provided by unauthenticated users in session files

GHSA-7vrx-9684-xrf2 · CVE-2025-35939

Affected

< 4.15.3 ≥ 5.0.0-alpha.1, < 5.7.5

Fixed in

4.15.3 5.7.5
HIGH 5 May 2025

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

GHSA-7c58-g782-9j38 · CVE-2025-46731

Affected

≥ 4.0.0-RC1, ≤ 4.14.12 ≥ 5.0.0-RC1, ≤ 5.6.14

Fixed in

no fix yet
CRITICAL10.0 25 Apr 2025

Craft CMS Allows Remote Code Execution

GHSA-f3gw-9ww9-jmc3 · CVE-2025-32432

Affected

≥ 3.0.0-RC1, ≤ 3.9.14 ≥ 4.0.0-RC1, ≤ 4.14.14 ≥ 5.0.0-RC1, ≤ 5.6.16

Fixed in

no fix yet
CRITICAL 10 Apr 2025

Craft CMS 4.14.15 is a critical release

craft-critical

Affected

< 3.9.15 < 3.9.14 ≥ 4.0.0-dev, < 4.14.15
and 1 more ≥ 5.0.0-dev, < 5.6.17

Fixed in

3.9.14 3.9.15 4.14.15
and 1 more 5.6.17
HIGH8.0 21 Jan 2025

Craft CMS has a potential RCE with a compromised security key

GHSA-x684-96hh-833x · CVE-2025-23209

Affected

≥ 4.0.0-RC1, < 4.13.8 ≥ 5.0.0-RC1, < 5.5.5

Fixed in

4.13.8 5.5.5
CRITICAL9.8 18 Dec 2024

Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

GHSA-2p6p-9rc9-62j9 · CVE-2024-56145

Affected

≥ 3.0.0, < 3.9.14 ≥ 4.0.0-RC1, < 4.13.2 ≥ 5.0.0-RC1, < 5.5.2

Fixed in

3.9.14 4.13.2 5.5.2
HIGH7.2 13 Nov 2024

Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

GHSA-f3cw-hg6r-chfv · CVE-2024-52293

Affected

≥ 4.0.0-RC1, ≤ 4.12.1 ≥ 5.0.0-RC1, ≤ 5.4.2

Fixed in

no fix yet
HIGH7.7 13 Nov 2024

Craft CMS Arbitrary System File Read

GHSA-cw6g-qmjq-6w2w · CVE-2024-52292

Affected

≥ 3.5.13, ≤ 4.12.6.1 ≥ 5.0.0-alpha.1, ≤ 5.4.7.1

Fixed in

no fix yet
HIGH8.4 13 Nov 2024

Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

GHSA-jrh5-vhr9-qh7q · CVE-2024-52291

Affected

≥ 4.0.0-RC1, ≤ 4.12.4.1 ≥ 5.0.0-RC1, ≤ 5.4.5.1

Fixed in

no fix yet
MODERATE5.5 9 Sep 2024

Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

GHSA-28h4-788g-rh42 · CVE-2024-45406

Affected

≥ 5.0.0, < 5.1.2

Fixed in

5.1.2
MODERATE4.8 25 Jul 2024

Craft CMS Allows TOTP Token To Stay Valid After Use

GHSA-wmx7-pw49-88jx · CVE-2024-41800

Affected

≥ 5.0.0-beta.1, ≤ 5.2.2

Fixed in

no fix yet
CRITICAL9.8 25 Jun 2024

Craft CMS SQL injection vulnerability via the GraphQL API endpoint

GHSA-hq4f-mv3q-8wcv · CVE-2024-37843

Affected

≤ 3.7.31

Fixed in

no fix yet
HIGH7.5 30 Jan 2024

Craft CMS Feed-Me

GHSA-6p78-f7h9-6838 · CVE-2023-36260

Affected

< 4.6.2

Fixed in

4.6.2
MODERATE5.4 3 Jan 2024

Craft CMS Privilege Escalation

GHSA-j5g9-j7r4-6qvx · CVE-2024-21622

Affected

≥ 3.0.0, ≤ 3.9.5 ≥ 4.0.0-RC1, ≤ 4.5.10

Fixed in

no fix yet
CRITICAL10.0 13 Sep 2023

Craft CMS Remote Code Execution vulnerability

GHSA-4w8r-3xrw-v25g · CVE-2023-41892

Affected

≥ 4.0.0-RC1, ≤ 4.4.14

Fixed in

no fix yet
HIGH7.2 21 Aug 2023

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

GHSA-44wr-rmwq-3phw · CVE-2023-40035

Affected

≥ 3.0.0, ≤ 3.8.14 ≥ 4.0.0-RC1, ≤ 4.4.14

Fixed in

no fix yet
MODERATE6.1 20 Jun 2023

Craft CMS vulnerable to HTML injection

GHSA-m3v5-gjj9-rg24 · CVE-2023-33495

Affected

≤ 4.4.9

Fixed in

no fix yet
MODERATE5.4 26 May 2023

Stored cross site scripting in Craft CMS

GHSA-7x94-jx75-3gh6 · CVE-2023-2817

Affected

≥ 4.0.0-RC1, < 4.4.12

Fixed in

4.4.12
MODERATE5.5 26 May 2023

Craft CMS stored XSS in indexedVolumes

GHSA-6qjx-787v-6pxr · CVE-2023-33197

Affected

≥ 4.0.0-RC1, ≤ 4.4.5

Fixed in

no fix yet
MODERATE5.5 26 May 2023

Craft CMS stored XSS in review volume

GHSA-cjmm-x9x9-m2w5 · CVE-2023-33196

Affected

≥ 4.0.0-RC1, ≤ 4.4.6

Fixed in

no fix yet
MODERATE6.1 26 May 2023

Craft CMS XSS in RSS widget feed

GHSA-qpgm-gjgf-8c2x · CVE-2023-33195

Affected

≥ 4.3.0, ≤ 4.4.5

Fixed in

no fix yet
LOW3.7 26 May 2023

CraftCMS stored XSS in Quick Post widget error message

GHSA-3wxg-w96j-8hq9 · CVE-2023-33194

Affected

≥ 3.0.0, ≤ 3.8.5 ≥ 4.0.0-RC1, < 4.4.6

Fixed in

4.4.6
HIGH7.2 22 May 2023

Craft CMS vulnerable to Remote Code Execution via unrestricted file extension

GHSA-vqxf-r9ph-cc9c · CVE-2023-32679

Affected

≥ 4.0.0, < 4.4.6

Fixed in

4.4.6
HIGH8.8 12 May 2023

CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

GHSA-fjx5-xm7q-whvj · CVE-2023-30130

Affected

≤ 3.8.1

Fixed in

no fix yet
MODERATE6.1 5 May 2023

craftcms/cms vulnerable to cross site scripting in RSS feed widget

GHSA-j4mx-98hw-6rv6 · CVE-2023-31144

Affected

≥ 3.0.0, ≤ 3.8.3 ≥ 4.0.0, ≤ 4.4.3

Fixed in

no fix yet
MODERATE6.1 25 Apr 2023

Cross Site Scripting in CraftCMS

GHSA-wv7j-rc2q-9j67 · CVE-2023-30177

Affected

< 3.7.68

Fixed in

3.7.68
MODERATE6.1 3 Mar 2023

Craft CMS Stored Cross-site Scripting Injection Vulnerability

GHSA-qcrj-6ffc-v7hq · CVE-2023-23927

Affected

≥ 3.7.24, < 3.7.64 ≥ 4.0.0-RC1, < 4.3.7

Fixed in

3.7.64 4.3.7
HIGH7.5 5 Dec 2022

Craft CMS discloses password hashes

GHSA-h972-v458-m892 · CVE-2022-37783

Affected

≥ 3.0.0, ≤ 3.7.32

Fixed in

no fix yet
MODERATE5.4 22 Sep 2022

Craft CMS Cross-site Scripting vulnerability

GHSA-f546-v666-559x · CVE-2022-37246

Affected

≥ 3.7.39, < 3.7.51 ≥ 4.0.0-RC1, < 4.2.1

Fixed in

3.7.51 4.2.1
MODERATE5.4 17 Sep 2022

Craft CMS Stored Cross-site Scripting in User Addresses Title

GHSA-8r89-x93x-mjq2 · CVE-2022-37250

Affected

≥ 4.0.0-RC1, < 4.2.1

Fixed in

4.2.1
MODERATE5.4 17 Sep 2022

Craft CMS Cross site Scripting vulnerability

GHSA-wxvf-839f-jqmh · CVE-2022-37248

Affected

≥ 4.0.0-RC1, < 4.2.1

Fixed in

4.2.1
MODERATE5.4 17 Sep 2022

Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page

GHSA-3cvm-7wrh-qrf9 · CVE-2022-37247

Affected

≥ 4.0.0-RC1, < 4.2.1

Fixed in

4.2.1
MODERATE5.4 17 Sep 2022

Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts

GHSA-mw37-wx8p-gp45 · CVE-2022-37251

Affected

≥ 3.7.0-beta.1, < 3.7.55.2 ≥ 4.0.0-RC1, < 4.2.1

Fixed in

3.7.55.2 4.2.1
MODERATE5.4 24 May 2022

Craft CMS Cross-site Scripting Vulnerability

GHSA-33jj-92px-m4g7 · CVE-2020-19626

Affected

< 3.1.33

Fixed in

3.1.33
CRITICAL9.8 24 May 2022

Craft CMS possibility of brute force attempts

GHSA-wvr4-w6cw-4px8 · CVE-2019-15929

Affected

< 3.1.7

Fixed in

3.1.7
MODERATE6.1 24 May 2022

Craft CMS XSS Vulnerability

GHSA-f3xr-q258-h7m9 · CVE-2019-17496

Affected

< 3.3.8

Fixed in

3.3.8
MODERATE6.1 24 May 2022

Craft CMS XSS Vulnerability

GHSA-w5q4-q7wp-qww6 · CVE-2019-12823

Affected

< 3.1.31

Fixed in

3.1.31
MODERATE6.1 17 May 2022

Craft CMS XSS Vulnerability

GHSA-xv5f-2997-qhrq · CVE-2017-8052

Affected

< 2.6.2974

Fixed in

2.6.2974
MODERATE6.1 17 May 2022

Craft CMS XSS Vulnerability

GHSA-9mcw-mwxv-grwj · CVE-2017-8384

Affected

< 2.6.2976

Fixed in

2.6.2976
MODERATE5.3 17 May 2022

Craft CMS subject to URL forgery

GHSA-j27g-r58q-624w · CVE-2017-8385

Affected

< 2.6.2976

Fixed in

2.6.2976
MODERATE5.4 17 May 2022

Craft CMS XSS Vulnerability

GHSA-6pvw-hh48-jx7p · CVE-2017-9516

Affected

< 2.6.2982

Fixed in

2.6.2982
MODERATE4.8 14 May 2022

Craft CMS Cross-site Scripting (XSS) Vulnerability

GHSA-72pf-cvwq-vgqg · CVE-2018-20418

Affected

≤ 3.0.25

Fixed in

no fix yet
HIGH7.2 13 May 2022

Craft CMS Vulnerable to Server-Side Template Injection

GHSA-j7fx-v37j-v3w7 · CVE-2018-20465

Affected

≤ 3.0.34

Fixed in

no fix yet
MODERATE5.3 13 May 2022

Craft CMS Unauthorized View

GHSA-7qq6-fgpw-xw45 · CVE-2017-8383

Affected

< 2.6.2976

Fixed in

2.6.2976
HIGH8.8 13 May 2022

Craft CMS PHP Code Injection Vulnerability

GHSA-r342-vjc4-wrmj · CVE-2018-3814

Affected

≤ 2.6.3000

Fixed in

no fix yet
HIGH8.8 10 May 2022

Improper account password reset in Craft CMS

GHSA-5cjr-78cq-3wrg · CVE-2022-29933

Affected

< 3.7.36

Fixed in

3.7.36
LOW 5 Apr 2022

XSS Injection Vulnerability

GHSA-wf98-vxv9-jqfv

Affected

< 3.7.29

Fixed in

3.7.29
MODERATE6.1 4 Apr 2022

Cross-site Scripting in craftcms/cms

GHSA-7xj5-fwqr-5378 · CVE-2022-28378

Affected

< 3.7.29

Fixed in

3.7.29
MODERATE6.1 18 Mar 2022

Craft CMS Cross-site Scripting Vulnerability

GHSA-h2rj-8wgg-mm43 · CVE-2021-32470

Affected

< 3.6.13

Fixed in

3.6.13
HIGH8.8 18 Oct 2021

CSV Injection Vulnerability

GHSA-h7vq-5qgw-jwwq · CVE-2021-41824

Affected

≥ 3.4.0, < 3.7.14

Fixed in

3.7.14
CRITICAL9.8 2 Jul 2021

Craft CMS Remote Code Injection

GHSA-x2j7-6hxm-87p3 · CVE-2021-27903

Affected

< 3.6.7

Fixed in

3.6.7
MODERATE6.1 2 Jul 2021

Craft CMS Cross-site Scripting Vulnerability

GHSA-3jxh-789f-p7m6 · CVE-2021-27902

Affected

< 3.6.0

Fixed in

3.6.0
/advisories/composer/craftcms/cms/feed.rss

From Packagist and the GitHub advisory database · synced hourly

Same vendor

craftcms/aws-s31 advisory craftcms/azure-blob1 advisory

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →