Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34

Export CSV
CVE-2026-86732

Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-79989

Arbitrary user password reset leading to administrator account takeover

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-86730

Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-79991

Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-79990

GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-79988

Authenticated RCE through Twig sandbox escape

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-78416

Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Craftcms
Products
Cms
CVE-2026-56381

Craft CMS - Stored XSS via User Group Name in User Permissions Page

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56382

Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout() without calling Component::cleanseConfig(). An authenticated admin user can inject Yii2 event handlers (e.g., 'on init' keys) via the fieldLayoutConfig parameter to execute arbitrary PHP code and disclose sensitive information (such as environment variables containing database credentials and CRAFT_SECURITY_KEY). The issue is fixed in version 5.9.14.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56383

Craft CMS - Stored XSS in Table Field via Row Heading Column Type

Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administrator account (with allowAdminChanges enabled) to inject arbitrary JavaScript that executes when another user views a page containing the affected table field. Affected versions are >= 4.5.0-beta.1 through 4.16.18 and >= 5.0.0-RC1 through 5.8.22; fixed in 4.16.19 and 5.8.23.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56384

Craft CMS - Missing Authorization in assets/preview-thumb Endpoint

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56385

Craft CMS - Authorization Bypass in assets/preview-file Endpoint

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56393

Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options

Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig template, which used {{ label|raw }}). An authenticated administrator (with allowAdminChanges enabled) can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions. Fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms
CVE-2026-56394

Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Craftcms Juzaweb
Products
Craftcms Cms