Skip to content
OpenAdvisories

Package · Packagist

automad/automad

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 7.5
    CVE-2026-45332 Public exploit Scanner template

    Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

    Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a sing…

    marcantondahmen automad automad/automad Packagist
  • High 8.8
    CVE-2024-40400

    Automad arbitrary file upload vulnerability

    An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file.

    automad/automad Packagist
  • Medium 4.3
    CVE-2023-7038

    automad User Creation cross-site request forgery

    A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cros…

    automad/automad Packagist
  • Medium 6.3
    CVE-2023-7037

    automad FileController.php import server-side request forgery

    A vulnerability was found in automad up to 1.10.9. It has been declared as critical. This vulnerability affects the function import of the file FileController.php. The manipulation of the argument importUrl leads to server-side request forgery. The attack can…

    automad/automad Packagist
  • Medium 5.4
    CVE-2021-37502

    Cross site scripting in automad/automad

    Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.

    automad/automad Packagist