craftcms/cms vulnerabilities

CVEs whose affected-version data names the craftcms/cms package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

craftcms/cms vulnerabilities

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Craft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Craft CMS: Stored XSS in the control panel via unescaped draft name

Craft CMS: Incorrect path validation could potentially lead to path traversal

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Craft CMS: Authenticated leak of secret environment variables

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read

Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Craft CMS: Stored XSS via Structure entry title in table view

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs