Craft CMS

Records204All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high90CVSS 7.0–8.9

Exploited now

Craft CMS records in CISA KEV

TI-2025-23503 Craft CMS Code Injection Vulnerability CRITICAL 100KEV 2026-03-20 TI-2024-37138 Craft CMS Code Injection Vulnerability CRITICAL 99KEV 2025-06-02 TI-2025-24595 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability CRITICAL 88KEV 2025-06-02 TI-2025-16994 Craft CMS Code Injection Vulnerability CRITICAL 94KEV 2025-02-20

Components

Products in the NVD configurations · select one to filter the records

Craft Cms 97 records CRITICAL Craft Commerce 17 records HIGH

Records

204 records

TI-2025-23503 CVE-2025-32432 · GHSA-f3gw-9ww9-jmc3

Craft CMS Allows Remote Code Execution

CRITICAL 100KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99792 Published 2025-04-25 Fixed in 3.9.15, 4.14.15 +1 CWE-94

TI-2024-37138 CVE-2024-56145 · GHSA-2p6p-9rc9-62j9

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

CRITICAL 99KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.97482 Published 2024-12-18 Fixed in 4.13.2, 5.5.2 +1 CWE-94

TI-2025-16994 CVE-2025-23209 · GHSA-x684-96hh-833x

Potential RCE with a compromised security key in craft/cms

CRITICAL 94KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.21642 Published 2025-01-18 Fixed in 5.5.5, 4.13.8 +1 CWE-94

TI-2025-24595 CVE-2025-35939 · GHSA-7vrx-9684-xrf2

Craft CMS stores user-provided content in session files

CRITICAL 88KEV

Craft CMS stores arbitrary content provided by unauthenticated users in session files.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01373 Published 2025-05-07 Fixed in 5.7.5, 4.15.3 CWE-472

TI-2023-22284 CVE-2023-41892 · GHSA-4w8r-3xrw-v25g

Craft CMS Remote Code Execution vulnerability

CRITICAL 87

Craft CMS is a platform for creating digital experiences.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.94215 Published 2023-09-13 Fixed in 4.4.15 CWE-94

TI-2024-25171 CVE-2024-37843 · GHSA-hq4f-mv3q-8wcv

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

HIGH 81

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53242 Published 2024-06-25 No fix listed CWE-89

TI-2020-19206 CVE-2020-37071 · GHSA-m7vh-5428-ff4x

CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution

HIGH 81

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00747 Published 2026-02-03 No fix listed CWE-502

TI-2020-07842 CVE-2020-9757 · GHSA-6q4j-8pjm-5mgc

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection…

HIGH 80

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72821 Published 2020-03-04 Fixed in 3.3.0 CWE-74

TI-2026-23289 CVE-2026-29172 · GHSA-j3x5-mghf-xvfw

Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting

HIGH 79

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00474 Published 2026-03-10 Fixed in 4.10.2, 5.5.3 CWE-89

TI-2026-22911 CVE-2026-28697 · GHSA-v47q-jxvr-p68x

Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

HIGH 76

Craft is a content management system (CMS).

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.01188 Published 2026-03-04 Fixed in 5.9.0-beta.1, 4.17.0-beta.1 CWE-1336

TI-2023-14144 CVE-2023-30130 · GHSA-fjx5-xm7q-whvj

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via…

HIGH 73

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01416 Published 2023-05-12 No fix listed CWE-94

TI-2026-40745 CVE-2026-56382 · GHSA-86vw-x4ww-x467

Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController

HIGH 72

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig POST p…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00676 Published 2026-06-21 Fixed in 5.9.14 CWE-94

TI-2026-32054 CVE-2026-44011 · GHSA-qrgm-p9w5-rrfw

Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

HIGH 72

Craft CMS is a content management system (CMS).

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0062 Published 2026-05-12 Fixed in 4.17.12, 5.9.18 CWE-479

TI-2026-23292 CVE-2026-29175 · GHSA-cfpv-rmpf-f624

Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking

HIGH 72

Craft Commerce is an ecommerce platform for Craft CMS.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00235 Published 2026-03-10 Fixed in 5.5.3 CWE-79

TI-2025-41988 CVE-2025-68455 · GHSA-255j-qw47-wjh5

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

HIGH 72

Craft is a platform for creating digital experiences.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00966 Published 2026-01-05 Fixed in 5.8.21, 4.16.17 CWE-470

TI-2024-34966 CVE-2024-52291 · GHSA-jrh5-vhr9-qh7q

Path traversal in Craft CMS cms

HIGH 72

Craft is a content management system (CMS).

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.01253 Published 2024-11-13 Fixed in 5.4.6, 4.12.5 CWE-22

TI-2026-25589 CVE-2026-33159 · GHSA-6mrr-q3pj-h53w

Missing authentication in Craft CMS cms

HIGH 70

Craft CMS is a content management system (CMS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-03-24 Fixed in 4.17.8, 5.9.14 CWE-306

TI-2026-24796 CVE-2026-32267 · GHSA-cc7p-2j3x-x7xf

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

HIGH 69

Craft CMS is a content management system (CMS).

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.09563 Published 2026-03-16 Fixed in 4.17.6, 5.9.12 CWE-863

TI-2026-37022 CVE-2026-50279 · GHSA-qq2c-2q8j-jh27

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

HIGH 68

Craft CMS is a content management system (CMS).

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-01 Fixed in 5.9.21 CWE-285

TI-2025-29402 CVE-2025-46731 · GHSA-7c58-g782-9j38

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

HIGH 67

Craft is a content management system.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.01544 Published 2025-05-05 Fixed in 4.14.13, 5.6.15 CWE-1336

TI-2024-34968 CVE-2024-52293 · GHSA-f3cw-hg6r-chfv

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

HIGH 67

Craft is a content management system (CMS).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01358 Published 2024-11-13 Fixed in 4.12.2, 5.4.3 CWE-22

TI-2024-34967 CVE-2024-52292 · GHSA-cw6g-qmjq-6w2w

Craft Allows Attackers to Read Arbitrary System Files

HIGH 67

Craft is a content management system (CMS).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00746 Published 2024-11-13 Fixed in 5.4.9, 4.12.8 CWE-22

TI-2023-20925 CVE-2023-40035 · GHSA-44wr-rmwq-3phw

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

HIGH 67

Craft is a CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02317 Published 2023-08-23 Fixed in 4.4.15, 3.8.15 CWE-74

TI-2023-15955 CVE-2023-32679 · GHSA-vqxf-r9ph-cc9c

Remote Code Execution via unrestricted file extension in Craft CMS

HIGH 67

Craft CMS is an open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01845 Published 2023-05-19 Fixed in 4.4.6 CWE-74

TI-2023-14158 CVE-2023-30179

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).

HIGH 67

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02203 Published 2023-06-13 No fix listed CWE-94

Open these records in search →