---
id: CVE-2024-32641
title: Masa CMS is an open source Enterprise Content Management platform
summary: >-
  Masa CMS is an open source Enterprise Content Management platform. Masa CMS
  versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code
  execution. The vulnerability exists in the addParam function, which accepts
  user input v…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: masacms
product: masacms
affected:
  - masacms < 7.2.8
  - 'masacms >= 7.3, < 7.3.13'
  - 'masacms >= 7.4.0, < 7.4.6'
patched:
  - masacms 7.4.6
published: '2025-12-03'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T21:10:00.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-32641'
references:
  - url: >-
      https://github.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6
    label: security-advisories@github.com
  - url: 'https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjm'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.12297
epssPercentile: 0.96052
ingestedAt: '2026-09-26T21:38:01.493Z'
---

## Overview

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

## Affected

- `masacms < 7.2.8`
- `masacms >= 7.3, < 7.3.13`
- `masacms >= 7.4.0, < 7.4.6`

## Remediation

Upgrade past the affected range:

- `masacms 7.4.6`