Craft CMS craftcms Craft CMS any version

Craft CMS Allows Remote Code Execution

Craft CMS Remote Code Execution vulnerability

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

Craft has a Twig Function Blocklist Bypass

Unauthenticated Craft CMS users can trigger a database backup

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).

Craft CMS before 3.7.14 allows CSV injection.

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Craft CMS Privilege Escalation

Craft has a SQL Injection in Element Indexes via criteria[orderBy]

Craft contains a theoretical bypass for CVE-2025-23209

Craft has a GraphQL Asset Mutation Privilege Escalation

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Craft affected by IDOR via GraphQL @parseRefs

Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Potential RCE with a compromised security key in craft/cms

Craft Allows Attackers to Read Arbitrary System Files

An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.

Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

Craft CMS Allows TOTP Token To Stay Valid After Use

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

Remote Code Execution via unrestricted file extension in Craft CMS

Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field.

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

Craft Potential Remote Code Execution via Twig SSTI