craftcms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object templHigh 8.7 · Oct 23, 2026
• CVE-2026-115937 The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash High 8.7 · Oct 23, 2026
• CVE-2026-115935 The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.High 8.7 · Oct 23, 2026
• CVE-2026-112777 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive whiHigh 8.7 · Oct 19, 2026
• CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because Critical 9.3 · Oct 19, 2026
• CVE-2026-112775 Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email High 8.7 · Oct 19, 2026
• CVE-2026-112774 Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying High 8.7 · Oct 19, 2026
• CVE-2026-112773 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by paHigh 8.7 · Oct 19, 2026
• CVE-2026-112772 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via AHigh 8.7 · Oct 19, 2026
• CVE-2026-112771 Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and muHigh 7.1 · Oct 19, 2026
• CVE-2026-112770 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow argumeHigh 8.7 · Oct 19, 2026
• CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without CHigh 8.7 · Oct 12, 2026
• CVE-2026-109305 Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" oHigh 8.7 · Oct 12, 2026
• CVE-2026-105985 Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.High 8.7 · Oct 6, 2026
• CVE-2026-92594 Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-dataHigh 8.7 · Sep 16, 2026
• CVE-2026-92593 Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sHigh 8.7 · Sep 16, 2026
• CVE-2026-92592 Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used High 8.7 · Sep 16, 2026
• CVE-2026-92591 Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — includingHigh 8.2 · Sep 16, 2026
• CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.High 8.7 · Sep 10, 2026
• CVE-2026-86732 Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instaHigh 8.7 · Sep 8, 2026
• CVE-2026-86731 Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action).High 7.1 · Sep 8, 2026
• CVE-2026-86730 Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavioHigh 8.7 · Sep 8, 2026
• CVE-2026-79991 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), High 7.1 · Sep 2, 2026
• CVE-2026-79990 Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), High 8.7 · Sep 2, 2026
• CVE-2026-79989 The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session.High 8.7 · Sep 2, 2026