Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
118 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and ALLOWADMINCHANGES must be enabled for this to work. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Note: This is a follow-up to https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv Users should update to the patched versions (4.14.13 and 5.6.15) to mitigate the issue. References https://github.com/craftcms/cms/pull/17026
Recommended action: Upgrade to 5.6.15 or 4.14.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is an additional fix for https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g This is a high-impact, low-complexity attack vector. To mitigate the issue, users running Craft installations before the fixed versions are encouraged to update to at least that version. Details https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 References https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47 https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/ Credits Credit to Orange Cyberdefense for discovering a reporting this bug.
Recommended action: Upgrade to 5.6.17, 4.14.15 or 3.9.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue.
Recommended action: Upgrade to 5.5.2, 4.13.2 or 3.9.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. (Post-authentication, ALLOWADMINCHANGES=true) Details Note: This is a sequel to CVE-2023-40035 In src/helpers/FileHelper.php#L106-L137, the function absolutePath returned $from . $ds . $to without path normalization: This could leads to multiple security risks, one of them is in src/services/Security.php#L201-L220 where ../templates/poc is not considered a system dir. Let's see what happens after calling isSystemDir("../templates/poc"): Now that the path ../templates/poc can bypass isSystemDir, it will also bypass the function validatePath in src/fs/Local.php#L124-L136: We can now create a Local filesystem within the system directories, particularly in /var/www/html/templates/poc Then create a new asset volume with that filesystem, upload a poc.ttml file with twig code and execute using a new route with template path poc/poc.ttml Although craftcms…
Recommended action: Upgrade to 5.4.3 or 4.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
By abusing the mail notification template it is possible to read arbitrary operating system files. Details The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. Requirements: write permissions to system notification templates ability to trigger a corresponding system email PoC 1) Modify a template to contain the following twig template string: 2) Trigger the corresponding notification email (e.g. by resetting a password) 3) Receive the email and decode the base64 string Mail received: Decoded string: Impact 1)…
Recommended action: Upgrade to 5.4.9 or 4.12.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Details The issue lies in line 57 of cms/src/helpers/FileHelper.php, it only removes file:// on the most left. It is trivial to bypass this sanitization by adding 2 file://, e.g. file://file:////. PoC 1. Sign in with an admin account and navigate to Settings → Assets, then create a new volume. 2. n the Asset Filesystem section, create a…
Recommended action: Upgrade to 5.4.6 or 4.12.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't sanitized and triggered xss. 3. In the /admin/entries page, entry title isn't sanitized and triggered xss. 4. In the entry edit page under the /admin/entries/, entry title in breadcrumb list isn't sanitized and triggered xss. 5. In the /admin/myaccount and pages under it, username or full name in breadcrumb list isn't sanitized and triggered xss. Impact Malicious users can tamper with the control panel. PoC 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't sanitized and triggered xss. 3. In the /admin/entries page, entry title isn't sanitized and triggered xss. 4.…
Recommended action: Upgrade to 5.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. Impact An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowledge of the victim's credentials. A TOTP token can be used multiple times to establish an authenticated session. RFC 6238 insists that an OTP must not be used more than once. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP. The OWASP Application Security Verification Standard v4.0.3 (ASVS) reiterates this property with requirement 2.8.4. Verify that time-based OTP can be used only once within the validity period. It should also be noted that the validity period of an TOTP token is 2 minutes. This makes a successful brute force attack more likely, since the four tokens are valid at the same time. Patches This has been patched in Craft 5.2.3.…
Recommended action: Upgrade to 5.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue discovered in Craft CMS version 4.6.1.1 allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.
Recommended action: Upgrade to 4.6.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups. Patches This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. References https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16
Recommended action: Upgrade to 4.5.11 or 3.9.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. Mitigations This has been fixed in Craft 4.4.15. You should ensure you’re running at least that version. Refresh your security key in case it has already been captured. You can do that by running the php craft setup/security-key command and copying the updated CRAFTSECURITYKEY environment variable to all production environments. If you have any other private keys stored as environment variables (e.g., S3 or Stripe), refresh those as well. Out of an abundance of caution, you may want to force all your users to reset their passwords in case your database was compromised. You can do that by running php craft resave/users --set passwordResetRequired --to "fn() = true". References…
Recommended action: Upgrade to 4.4.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Bypassing the validatePath function can lead to potential Remote Code Execution (Post-authentication, ALLOWADMINCHANGES=true) Details In bootstrap.php, the SystemPaths path is set as below. Because paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir() ref. https://www.php.net/manual/en/wrappers.file.php PoC 1) Create a new filesystem. Base Path: file:///var/www/html/templates 2) Create a new asset volume. Asset Filesystem: localbypass 3) Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates 4) Create a new route. URI: , Template: poc.ttml 5) Confirm RCE on arbitrary path ( / ) PoC Env Impact Take control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc. although the vulnerability is exploitable only in the authenticated users, configuration with ALLOWADMINCHANGES=true, there is still a potential…
Recommended action: Upgrade to 4.4.15 or 3.8.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.
Recommended action: Upgrade to 4.4.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XSS can be triggered via the Update Asset Index utility PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<scriptalert(26)</script 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 7. Click Update asset indexes. XSS will be triggered Json response volumes name makes triggers the payload "session":{"id":1,"indexedVolumes":{"1":"\"<scriptalert(26)</script"}, It’s run on every POST request in the utility. Resolved in https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766
Recommended action: Upgrade to 4.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
XSS can be triggered by review volumes PoC 1. Access setting tab 2. Create new assets 3. In assets name inject payload: "<scriptalert(1337)</script 4. Click Utilities tab 5. Choose all volumes, or volume trigger xss 6. Click Update asset indexes. 7. Wait to assets update success. 8. Progress complete. 9. Click on review button will trigger XSS Root cause Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770 After loading completed, progess will load: "skippedEntries" and "missingEntries" These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries" My reponse: { "session": { "id": 10, "indexedVolumes": { "6": "\"<scriptalert(1337)</script" }, "totalEntries": 2235, "processedEntries": 2235, "cacheRemoteImages": true, "listEmptyFolders": false, "isCli": false, "actionRequired": true, "dateCreated": "Apr 5, 2023, 9:03:16 AM", "skippedEntries": …
Recommended action: Upgrade to 4.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag <item Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Recommended action: Upgrade to 4.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, click Edit label 5. Inject the XSS payload into the label and save 6. On the admin dashboard choose new widget - Quick Post 7. In Quick Post, click save with blank slug; The XSS will be executed "errors":{"title":["<scriptalert('nono')</script cannot be blank."],"slug":["Slug cannot be blank."] Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Recommended action: Upgrade to 4.4.6 or 3.8.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unrestricted file extension lead to a potential Remote Code Execution (Authenticated, ALLOWADMINCHANGES=true) Details Vulnerability Cause : If the name parameter value is not empty string('') in the View.php's doesTemplateExist() - resolveTemplate() - resolveTemplateInternal() - resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates (even if they are not extensions set in defaultTemplateExtensions = ['html', 'twig']) When attacker with admin privileges on the DEV or Misconfigured STG, PROD, they can exploit this vulnerability to remote code execution (ALLOWADMINCHANGES=true) PoC Step 1) Create a new filesystem. Base Path: /var/www/html/templates Step 2) Create a new asset volume. Asset Filesystem: template Step 3) Upload poc file( .txt , .js , .json , etc ) with twig template rce payload Step 4) Create a new global set with template layout. The template filename is poc.js Step 5) When…
Recommended action: Upgrade to 4.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit.
Recommended action: Upgrade to 4.4.4 or 3.8.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
Recommended action: Upgrade to 3.7.68 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft CMS 4.3.6.1
Recommended action: Upgrade to 4.3.7 or 3.7.64 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. The CRAFTCSRFTOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
Recommended action: Upgrade to 3.7.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS 4.2.0.1 is affected by Cross Site Scripting (XSS) in the file src/web/assets/cp/src/js/BaseElementSelectInput.js and in specific on the line label: elementInfo.label.
Recommended action: Upgrade to 4.2.1 or 3.7.51 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.