Craft CMS

Records204All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high90CVSS 7.0–8.9

Exploited now

Craft CMS records in CISA KEV

TI-2025-23503 Craft CMS Code Injection Vulnerability CRITICAL 100KEV 2026-03-20 TI-2024-37138 Craft CMS Code Injection Vulnerability CRITICAL 99KEV 2025-06-02 TI-2025-24595 Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability CRITICAL 88KEV 2025-06-02 TI-2025-16994 Craft CMS Code Injection Vulnerability CRITICAL 94KEV 2025-02-20

Components

Products in the NVD configurations · select one to filter the records

Craft Cms 97 records CRITICAL Craft Commerce 17 records HIGH

Records

97 records in Craft Cms · all components

TI-2025-23503 CVE-2025-32432 · GHSA-f3gw-9ww9-jmc3

Craft CMS Allows Remote Code Execution

CRITICAL 100KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99792 Published 2025-04-25 Fixed in 3.9.15, 4.14.15 +1 CWE-94

TI-2024-37138 CVE-2024-56145 · GHSA-2p6p-9rc9-62j9

RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms

CRITICAL 99KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.97482 Published 2024-12-18 Fixed in 4.13.2, 5.5.2 +1 CWE-94

TI-2025-16994 CVE-2025-23209 · GHSA-x684-96hh-833x

Potential RCE with a compromised security key in craft/cms

CRITICAL 94KEV

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.21642 Published 2025-01-18 Fixed in 5.5.5, 4.13.8 +1 CWE-94

TI-2025-24595 CVE-2025-35939 · GHSA-7vrx-9684-xrf2

Craft CMS stores user-provided content in session files

CRITICAL 88KEV

Craft CMS stores arbitrary content provided by unauthenticated users in session files.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01373 Published 2025-05-07 Fixed in 5.7.5, 4.15.3 CWE-472

TI-2023-22284 CVE-2023-41892 · GHSA-4w8r-3xrw-v25g

Craft CMS Remote Code Execution vulnerability

CRITICAL 87

Craft CMS is a platform for creating digital experiences.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.94215 Published 2023-09-13 Fixed in 4.4.15 CWE-94

TI-2024-25171 CVE-2024-37843 · GHSA-hq4f-mv3q-8wcv

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

HIGH 81

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.53242 Published 2024-06-25 No fix listed CWE-89

TI-2020-07842 CVE-2020-9757 · GHSA-6q4j-8pjm-5mgc

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection…

HIGH 80

The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.72821 Published 2020-03-04 Fixed in 3.3.0 CWE-74

TI-2026-22911 CVE-2026-28697 · GHSA-v47q-jxvr-p68x

Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates

HIGH 76

Craft is a content management system (CMS).

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.01188 Published 2026-03-04 Fixed in 5.9.0-beta.1, 4.17.0-beta.1 CWE-1336

TI-2023-14144 CVE-2023-30130 · GHSA-fjx5-xm7q-whvj

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via…

HIGH 73

An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01416 Published 2023-05-12 No fix listed CWE-94

TI-2025-41988 CVE-2025-68455 · GHSA-255j-qw47-wjh5

Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

HIGH 72

Craft is a platform for creating digital experiences.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00966 Published 2026-01-05 Fixed in 5.8.21, 4.16.17 CWE-470

TI-2024-34966 CVE-2024-52291 · GHSA-jrh5-vhr9-qh7q

Path traversal in Craft CMS cms

HIGH 72

Craft is a content management system (CMS).

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.01253 Published 2024-11-13 Fixed in 5.4.6, 4.12.5 CWE-22

TI-2026-25589 CVE-2026-33159 · GHSA-6mrr-q3pj-h53w

Missing authentication in Craft CMS cms

HIGH 70

Craft CMS is a content management system (CMS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00376 Published 2026-03-24 Fixed in 4.17.8, 5.9.14 CWE-306

TI-2026-24796 CVE-2026-32267 · GHSA-cc7p-2j3x-x7xf

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

HIGH 69

Craft CMS is a content management system (CMS).

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.09563 Published 2026-03-16 Fixed in 4.17.6, 5.9.12 CWE-863

TI-2025-29402 CVE-2025-46731 · GHSA-7c58-g782-9j38

Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

HIGH 67

Craft is a content management system.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.01544 Published 2025-05-05 Fixed in 4.14.13, 5.6.15 CWE-1336

TI-2024-34968 CVE-2024-52293 · GHSA-f3cw-hg6r-chfv

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

HIGH 67

Craft is a content management system (CMS).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01358 Published 2024-11-13 Fixed in 4.12.2, 5.4.3 CWE-22

TI-2024-34967 CVE-2024-52292 · GHSA-cw6g-qmjq-6w2w

Craft Allows Attackers to Read Arbitrary System Files

HIGH 67

Craft is a content management system (CMS).

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00746 Published 2024-11-13 Fixed in 5.4.9, 4.12.8 CWE-22

TI-2023-20925 CVE-2023-40035 · GHSA-44wr-rmwq-3phw

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

HIGH 67

Craft is a CMS for creating custom digital experiences on the web and beyond.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02317 Published 2023-08-23 Fixed in 4.4.15, 3.8.15 CWE-74

TI-2023-15955 CVE-2023-32679 · GHSA-vqxf-r9ph-cc9c

Remote Code Execution via unrestricted file extension in Craft CMS

HIGH 67

Craft CMS is an open source content management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01845 Published 2023-05-19 Fixed in 4.4.6 CWE-74

TI-2023-14158 CVE-2023-30179

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).

HIGH 67

CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02203 Published 2023-06-13 No fix listed CWE-94

TI-2024-27845 CVE-2024-41800 · GHSA-wmx7-pw49-88jx

Craft CMS Allows TOTP Token To Stay Valid After Use

HIGH 66

Craft is a content management system (CMS).

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00459 Published 2024-07-25 Fixed in 5.2.3 CWE-287

TI-2022-17560 CVE-2022-37783 · GHSA-h972-v458-m892

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who…

HIGH 66

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01109 Published 2022-12-05 Fixed in 3.7.33 CWE-522

TI-2026-22976 CVE-2026-28781 · GHSA-2xfc-g69j-x2mp

Craft Affected by Entries Authorship Spoofing via Mass Assignment

MEDIUM 64

Craft is a content management system (CMS).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00388 Published 2026-03-04 Fixed in 5.9.0-beta.1, 4.17.0-beta.1 CWE-639

TI-2026-21578 CVE-2026-27127 · GHSA-gp2f-7wcm-5fhx

Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding

MEDIUM 64

Craft is a content management system (CMS).

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00487 Published 2026-02-24 Fixed in 4.16.19, 5.8.23 CWE-367

TI-2025-41989 CVE-2025-68456 · GHSA-v64r-7wg9-23pr

Unauthenticated Craft CMS users can trigger a database backup

MEDIUM 64

Craft is a platform for creating digital experiences.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.0056 Published 2026-01-05 Fixed in 5.8.21, 4.16.17 CWE-202

TI-2026-21577 CVE-2026-27126 · GHSA-3jh3-prx3-w6wc

Craft CMS has Stored XSS in Table Field via "HTML" Column Type

MEDIUM 60

Craft is a content management system (CMS).

CVSS 4.0MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00246 Published 2026-02-24 Fixed in 4.16.19, 5.8.23 CWE-79

Open these records in search →