Skip to content
OpenAdvisories

Package · Packagist

craftcms/cms

127 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 8.8
    CVE-2026-72781 Public exploit

    Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

    Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox all…

    craftcms cms craftcms/cms Packagist
  • High 8.8
    CVE-2026-72778 Public exploit

    Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

    Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array v…

    craftcms cms craftcms/cms Packagist
  • High 8.7
    CVE-2026-55794 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

    Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The iss…

    craftcms cms craftcms/cms Packagist
  • High 8.6
    CVE-2026-44011 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary command…

    craftcms cms craftcms/cms Packagist
  • High 8.6
    CVE-2026-33157 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

    Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previo…

    craftcms cms craftcms/cms Packagist
  • High 8.1
    CVE-2026-31857 Public exploit

    CraftCMS has an RCE vulnerability via relational conditionals in the control panel

    Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The BaseElementSelectConditionRule::getElementIds() method passes user-controlled string input through re…

    craftcms cms craftcms/cms Packagist
  • High 7.5
    CVE-2026-28695 Public exploit

    Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

    Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::cre…

    craftcms cms craftcms/cms Packagist
  • High 7.3
    CVE-2025-46731 Public exploit

    Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

    Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CH…

    craftcms cms craftcms/cms Packagist
  • Critical 10.0
    CVE-2025-32432 Exploited Public exploit EPSS 100%

    Craft CMS Allows Remote Code Execution

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. …

    craftcms cms craftcms/cms Packagist
    KEV Mar 20, 2026
  • Critical 9.3
    CVE-2024-56145 Exploited Public exploit EPSS 97%

    RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

    Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified…

    craftcms cms craftcms/cms Packagist
    KEV Jun 2, 2025
  • High 7.5
    CVE-2024-37843 Public exploit EPSS 53%

    Craft CMS SQL injection vulnerability via the GraphQL API endpoint

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    craftcms/cms Packagist
  • Critical 10.0
    CVE-2023-41892 Public exploit EPSS 94%

    Craft CMS Remote Code Execution vulnerability

    Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed i…

    craftcms cms craftcms/cms Packagist
  • Medium 4.8
    CVE-2018-20418 Public exploit

    Craft CMS Cross-site Scripting (XSS) Vulnerability

    index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2017-9516 Public exploit

    Craft CMS XSS Vulnerability

    Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

    craftcms/cms Packagist