Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: craftcms cms 4.18.7 Clear all filters
TI-2026-71124 CVE-2026-109308 · GHSA-r8mr-vm79-xxh4

Craft CMS behavior injection enables remote code execution

Priority MEDIUM 40

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handl…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0049 Published 2026-10-12 Fixed in 4.18.7, 5.10.14 CWE-94
TI-2026-71120 CVE-2026-109304 · GHSA-52mh-mf22-cc6j

Arbitrary file read in Craft CMS through Twig create() DOMDocument

Priority LOW 30

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00314 Published 2026-10-12 Fixed in 4.18.7, 5.10.14 CWE-200