Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
118 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. Proof of Concept Prerequisites - A user account with "Create Entries" permission for a section. - Victim's account ID (e.g., 1 for the default Admin). Steps to Reproduce 1. Log in as the attacker 1. Navigate to the "Entries" section and click "New Entry" 1. Fill in the required fields 1. Enable a proxy tool (e.g., Burp Suite) to intercept requests 1. Click "Save" & Intercept the request 1. In the request body, add a new parameter…
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. --- Proof of Concept Attack Prerequisites - Authenticated administrator account with allowAdminChanges enabled, or access to the System Messages utility Steps to Reproduce 1. Navigate to Utilities → System Messages (/admin/utilities/system-messages) 2. Edit any email template (e.g., "Test Email") and inject the following in the body (or the Subject): - To exploit it by writing to a file system: - Note: Replace the filesystem handle (e.g., hardDisk) with a valid handle configured in the target installation. - To exploit it by writing to a volume: - Note: Replace the volume handle (e.g., images) with a…
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
of all XSS Reports Multiple stored XSS vulnerabilities were found in Craft CMS. They were split into 4 reports as follows: | Report | What's Vulnerable | Why Separate | |--------|-------------------|--------------| | This Report (1) | Multiple settings names | Twig Template: includes/forms/checkbox.twig | | Report 2 | Entry Types Name | Twig Template: includes/forms/editableTable.twig | | Report 3 | Card Attributes in Field Layout | helpers/Cp.php | | Report 4 (Commerce) | Product Type Name | Source in Commerce, sink in CMS - will report this one via Commerce GHSA | Reports 2, 3, and 4 are clearly distinct locations. For this report (Report 1), it was not clear whether to split or consolidate these 7 bugs. The bug report was consolidated and the final categorization should be left to the judgement of the user. Note: This overview is only in this Report. Other reports only reference this one. --- Summary Stored XSS in multiple settings. Names/labels are rendered without…
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. Vulnerability Details craft\services\Elements::parseRefs identifies reference tags and resolves them using getRefTokenReplacement. This method fetches the referenced element and accesses the specified attribute via $element-$attribute. - Missing Auth Check: It bypasses canView() checks. - Polymorphic Access: getElementTypeByRefHandle allows referencing any element type (entry, asset, user, category). - Custom Field Access: Since Craft elements use get() to resolve custom field handles, an attacker is not limited to core attributes. They can exfiltrate any custom field data by…
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). Required Permissions - Administrator permissions or access to System Messages utility - allowAdminChanges enabled in production (against our security recommendations) or access to System Messages utility Vulnerability Details The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. Attack Vector Admin panel → Settings → Entry Types → Title Format field Proof of Concept Payload Steps to Reproduce 1. Log in as admin 2. Navigate to Settings → Entry Types 3. Edit any entry type’s "Title Format" field 4. Insert the payload above 5. Create/edit an entry of that type 6. Command executes, output appears…
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the Row Heading column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. Prerequisites An administrator account allowAdminChanges must be enabled in production, which is against security recommendations. Steps to Reproduce 1. Navigate to Settings → Fields and create a new field with Type: Table 1. Add a Column Heading and set Column Type to Row Heading 1. In Default Values section, add a row with the following payload: 1. Enable Static Rows 1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile 1. Notice the XSS execution Resources https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
Recommended action: Upgrade to 5.8.23 or 4.16.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SSRF validation in Craft CMS’s GraphQL Asset mutation uses gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, the function returns the hostname string itself, causing the blocklist comparison to always fail and completely bypassing SSRF protection. This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc). Required Permissions Exploitation requires GraphQL schema permissions for: - Edit assets in the <VolumeName volume - Create assets in the <VolumeName volume These permissions may be granted to: - Authenticated users with appropriate GraphQL schema access - Public Schema (if misconfigured with write permissions) --- Technical Details Root Cause From PHP documentation: "gethostbyname - Get the IPv4 address corresponding to a given Internet host name" When no IPv4 (A record) exists, gethostbyname() returns the hostname string unchanged. Bypass Mechanism --- Bypass Payloads Blocked IPv4 Addresses and Their IPv6…
Recommended action: Upgrade to 5.8.23 or 4.16.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The getTokenRoute() method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. References https://github.com/craftcms/cms/commit/3e4afe18279951c024c64896aa2b93cda6d95fdf
Recommended action: Upgrade to 5.8.23 or 4.16.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 (GHSA-x27p-wfqw-hfcc) that allows access to all blocked IPs, not just IPv6 endpoints. Severity Bypass of cloud metadata SSRF protection for all blocked IPs Required Permissions Exploitation requires GraphQL schema permissions for: - Edit assets in the <VolumeName volume - Create assets in the <VolumeName volume These permissions may be granted to: - Authenticated users with appropriate GraphQL schema access - Public Schema (if misconfigured with write permissions) --- Technical Details Vulnerable Code Flow The code at src/gql/resolvers/mutations/Asset.php performs two separate DNS lookups: Root Cause Two separate DNS…
Recommended action: Upgrade to 5.8.23 or 4.16.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored Cross-site Scripting (XSS) vulnerability exists in the editableTable.twig component when using the html column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. Prerequisites An administrator account allowAdminChanges must be enabled in production, which is against our security recommendations. Steps to Reproduce 1. Navigate to Settings → Fields and create a new field with Type: Table 1. Add a Column Heading and set Column Type to Single-line text - Note: The vulnerable Column Type is html, but it's not available in the UI dropdown. 1. In Default Values section, add a row with the following payload: 1. Enable Static Rows 1. Intercept the Save Field request using a proxy tool (e.g., Burp Suite) or use cURL directly 1. Modify the request body and change the types[craft-fields-Table][columns][col3][type] parameter from singleline to html 1. Forward the request to…
Recommended action: Upgrade to 5.8.23 or 4.16.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Relationship to Previously Patched Vulnerability This vulnerability is in addition to the RCE vulnerability patched in GHSA-255j-qw47-wjh5. That advisory addressed a similar RCE vulnerability that affected two specific routes: - /index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings - /index.php?p=admin%2Factions%2Ffields%2Frender-card-preview This one addresses some additional endpoints that were not covered in the https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5. The patched vulnerability used a malicious AttributeTypecastBehavior with a wildcard event listener ("on ": "self::beforeSave") and construct() syntax to trigger RCE via the typecastBeforeSave callback. The fix was implemented in commits: - 6e608a1 - 27f5588 - ec43c49 This vulnerability follows the same attack pattern (behavior injection via "as <behavior" syntax) but affects a different code path (assembleLayoutFromPost() in Fields.php) that was not patched in those commits. The…
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access. Summary: Type: Privilege Escalation (CWE-269) Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well) Location: src/gql/resolvers/mutations/Asset.php lines 57-107 Root Cause: The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer. Impact: - Transfer confidential assets from private volumes to public volumes (data exfiltration) - Modify asset metadata in restricted volumes - Bypass multi-tenant isolation in shared hosting environments
Recommended action: Upgrade to 5.9.0-beta.1 (pre-release) or 4.17.0-beta.1 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the |md|raw Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles. Proof of Concept Required Permissions - Administrator access - allowAdminChanges is enabled in production, which is against our security recommendations. Steps to Reproduce 1. Log in with an admin account 2. Navigate to Settings → Fields → New field 3. Choose Number as the field type 4. Set the Prefix/Suffix Text field to: <img width="611" height="908" alt="image" src="https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea-37364137527d" / 5. Save the field 6. Add this field to any element (e.g., User Profile fields via Settings → Users → User Fields) 7. Navigate to your account (/admin/myaccount) or any user profile (/admin/users/{id}) 8. XSS executes when viewing the form <img width="1246" height="677" alt="image-1"…
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). [!NOTE] The ORDER BY clause executes per row. SLEEP(1) on 10 rows = 10s delay. --- PoC Required Permissions - Access to the Control Panel Steps to reproduce 1. Log in to the control panel 2. Navigate to any element index (e.g., Users /admin/users, Entries, Assets, etc.) 3. Intercept the POST request to /index.php?p=admin/actions/element-indexes/get-elements 4. Modify the JSON body to the following: 5. Send the request 6. Observe a delay in the response (delay = rows × sleep time) Alternatively, you can use the following curl (bash syntax) command (replace cookie, CSRF token, and target domain as needed): Impact With this…
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
I observed a recent commit intended to mitigate Server-Side Request Forgery (SSRF) vulnerabilities. While the implemented defense mechanisms are an improvement, I have identified two methods to bypass these protections. This report details the first bypass method involving alternative IP notation, while the second method will be submitted in a separate advisory. --- Summary The saveAsset GraphQL mutation uses filtervar(..., FILTERVALIDATEIP) to block a specific list of IP addresses. However, alternative IP notations (hexadecimal, mixed) are not recognized by this function, allowing attackers to bypass the blocklist and access cloud metadata services. --- Proof of Concept 1. Send the following GraphQL mutation: 2. The IP validation passes (hex notation not recognized as IP) 3. Guzzle resolves 169.254.0xa9fe to 169.254.169.254 4. Cloud metadata is fetched and saved Alternative Payloads | Payload | Notation | Resolves To | |---------|----------|-------------| | http://169.254.0xa9fe/ |…
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzzle follows HTTP redirects by default. An attacker can bypass all SSRF protections by hosting a redirect that points to cloud metadata endpoints or any internal IP addresses. --- Proof of Concept 1. Host a redirect script on your server (e.g. redirect.php): 2. Send the following GraphQL mutation: 3. The application validates attacker.com (passes) 4. Guzzle follows the redirect to 169.254.169.254 5. Cloud metadata is saved as an asset --- Mitigation - Disable redirects.
Recommended action: Upgrade to 5.8.22 or 4.16.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. --- Proof of Concept Required Permissions (Attacker) - Admin access (only admins have access to the settings page) - allowAdminChanges is enabled in production, which is against our security recommendations. Steps to Reproduce 1. Log in as an attacker. 2. Go to Settings - Entry Types (/admin/settings/entry-types). 3. Create a new Entry Type. 4. Set Name to: 5. Save the Entry Type, and you’ll be redirected back to the entry types table automatically. 6. Notice the alert fires when the entry types table renders.
Recommended action: Upgrade to 5.8.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 Summary This was reported as a vulnerability in Yii framework on August 7th (https://github.com/yiisoft/yii2/security/advisories/GHSA-gcmh-9pjj-7fp4). The Yii framework team denies responsibility for this (placing the onus on application developers) and hence has not (and seemingly will not) provide a fix at the framework level. Hence, I am reporting this to Craft as I found it to affect the latest (5.6.0) version of Craft CMS. Leveraging a legitimate but maliciously crafted Yii…
Recommended action: Upgrade to 5.8.21 or 4.16.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthenticated users can trigger database backup operations the updater/backup action, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes. References: https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 Affected Endpoints - POST /admin/actions/updater/backup (unauthenticated) Vulnerability Details Root Cause All updater/ actions are explicitly configured with anonymous access: Attack Vector 1. Send unauthenticated POST request to /admin/actions/updater/backup 2. Database backup executes with configured backupCommand
Recommended action: Upgrade to 5.8.21 or 4.16.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
For this to work, users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Alternatively, a non-administrator account with allowAdminChanges disabled can be used, provided access to the System Messages utility is available. It is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. References: https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04
Recommended action: Upgrade to 5.8.21 or 4.16.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Craft CMS GraphQL save<VolumeNameAsset mutation is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability arises because the file input, specifically its url parameter, allows the server to fetch content from arbitrary remote locations without proper validation. Attackers can exploit this by providing internal IP addresses or cloud metadata endpoints as the url, forcing the server to make requests to these restricted services. The fetched content is then saved as an asset, which can subsequently be accessed and exfiltrated, leading to potential data exposure and infrastructure compromise. This exploitation requires specific GraphQL permissions for asset management within the targeted volume. Users should update to the patched 5.8.21 and 4.16.17 releases to mitigate the issue. References: https://github.com/craftcms/cms/commit/013db636fdb38f3ce5657fd196b6d952f98ebc52 https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 --- Required Permissions The…
Recommended action: Upgrade to 5.8.21 or 4.16.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Resources: https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9
Recommended action: Upgrade to 5.8.21 or 4.16.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Note: This is a follow-up to GHSA-f3cw-hg6r-chfv Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue. Resources: https://github.com/craftcms/cms/pull/17612
Recommended action: Upgrade to 5.8.7 or 4.16.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Pre-requisites: Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret) Somehow, manage to create an arbitrary file in Craft’s /storage/backups folder. With those two pieces in place, you could create a specific, malicious request to the /updater/restore-db endpoint to execute CLI commands remotely. Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57 ----- Reported by Marco O. (segfault)
Recommended action: Upgrade to 5.8.4 or 4.16.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at /var/lib/php/sessions. Such session files are named sess[sessionvalue], where [sessionvalue] is provided to the client in a Set-Cookie response header. Craft CMS stores the return URL requested by the client without sanitizing parameters. Consequently, an unauthenticated client can introduce arbitrary values, such as PHP code, to a known local file location on the server. Craft CMS versions 5.7.5 and 4.15.3 have been released to address this issue.
Recommended action: Upgrade to 5.7.5 or 4.15.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.