Skip to content
OpenAdvisories

Vendor

AlchemyCMS

3 known vulnerabilities.

Products

alchemy_cms 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-86777

    AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

    AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricte…

    AlchemyCMS alchemy_cms
  • Medium 6.4
    CVE-2026-23885 Public exploit

    AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

    Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby `eval()` function to dynamically execute a string provided by the `resource_handler.engine_name` attribute i…

    AlchemyCMS alchemy_cms alchemy_cms RubyGems