craftcms/cms vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-86VW-X4WW-X467Highcraftcms/cms: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview GHSA-C43V-4CR8-6MVPLowcraftcms/cms: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read CVE-2026-55794Highcraftcms/cms: Craft CMS: Potential authenticated Remote Code Execution via referrer redirect CVE-2026-55793Mediumcraftcms/cms: Craft CMS: Stored XSS via Structure entry title in table view CVE-2026-55792Mediumcraftcms/cms: Craft CMS: Sensitive File Disclosure / Server-Side File Read CVE-2026-55790Highcraftcms/cms: Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget GHSA-X76W-8C62-48MGMediumcraftcms/cms: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission CVE-2026-50282Highcraftcms/cms: Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves CVE-2026-50281Highcraftcms/cms: Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements CVE-2026-50284Highcraftcms/cms: Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets CVE-2026-50283Mediumcraftcms/cms: Craft CMS: Unauthorized Deletion of Source Assets During File Replacement CVE-2026-50280Mediumcraftcms/cms: Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check CVE-2026-50279Highcraftcms/cms: Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap CVE-2026-55791Criticalcraftcms/cms: Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CVE-2026-44012Highcraftcms/cms: Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure CVE-2026-44011Highcraftcms/cms: Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior CVE-2026-44010Highcraftcms/cms: Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure CVE-2026-41130Mediumcraftcms/cms: Craft CMS has a host header injection leading to SSRF via resource-js endpoint CVE-2026-41129Mediumcraftcms/cms: Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations CVE-2026-41128Mediumcraftcms/cms: Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action GHSA-44PX-QJJC-XRHQLowcraftcms/cms: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata CVE-2026-33162Mediumcraftcms/cms: Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions CVE-2026-33161Lowcraftcms/cms: Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users CVE-2026-33160Lowcraftcms/cms: Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL CVE-2026-33159Mediumcraftcms/cms: Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo