Skip to content
OpenAdvisories

Package · RubyGems

alchemy_cms

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2026-57579

    Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

    Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages…

    AlchemyCMS alchemy_cms alchemy_cms RubyGems
  • Medium 6.4
    CVE-2026-23885 Public exploit

    AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

    Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute i…

    AlchemyCMS alchemy_cms alchemy_cms RubyGems