66 results · Clear filters · Feed
-
Medium 4.3
Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement
Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to …
-
Medium 6.5
Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg
Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are…
-
Medium 6.5
Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the san…
-
Medium 4.7
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2…
-
Medium 5.9
Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when t…
-
Medium 4.9
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, ca…
-
Medium 5.9
Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available b…
-
Medium 5.4
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editabl…
-
Medium 4.3
Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author'…
-
Medium 6.5
Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the target…
-
Medium 4.3
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpo…
-
Medium 4.3
Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames…
-
Medium 6.3
Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvision…
-
Medium 4.3
Craft CMS before 5.10.11 Broken Access Control via element-indexes
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can reloca…
-
Medium 4.8
Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users vi…
-
Medium 6.4
Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name
Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious …
-
Medium 6.5
Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including …
-
Medium 4.3
Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reorde…
-
Medium 5.4
Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incompl…
-
Medium 6.5
Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An auth…
-
Medium 6.2
Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, s…
-
Medium 6.5
Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey
Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticate…
-
Medium 4.5
Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated admin…
-
Medium 4.9
Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without desti…
-
Medium 6.0
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission…
-
Medium 6.0
Craft CMS: Sensitive File Disclosure / Server-Side File Read
Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user grant…
-
Medium 6.9
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-…
-
Medium 5.3
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by suppl…
-
Medium 5.9
Craft CMS: Stored XSS via Structure entry title in table view
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structu…
-
Medium 6.5
Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter
Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences t…
-
Medium 4.8
Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options
Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization (e.g., via the checkbox.twig templ…
-
Medium 4.3
Craft CMS - Authorization Bypass in assets/preview-file Endpoint
Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated lo…
-
Medium 4.3
Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing…
-
Medium 4.8
Craft CMS - Stored XSS in Table Field via Row Heading Column Type
Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column type. The application fails to sanitize input within row heading default values, allowing an attacker with an administ…
-
Medium 4.8
Craft CMS - Stored XSS via User Group Name in User Permissions Page
Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group…
-
Medium 5.5
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When `trustedHosts` i…
-
Medium 5.5
Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations
Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. The exploitation requires a few permissions to be enabled in the used GraphQL schema: "E…
-
Medium 5.3
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups()` enforces per-grou…
-
Medium 4.9
Craft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions
Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntr…
-
Medium 6.9
Craft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync a…