TI-2026-51011 CVE-2026-72785 · GHSA-xxpx-f366-4xpq
Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
Priority MEDIUM 40
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability.
Vulnerabilities
6 records
TI-2026-51010 CVE-2026-72784 · GHSA-hvvw-h49x-4xmw
Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
Priority LOW 30
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL save<Volume>Asset mutation, which fetches an attacker-supplied URL server-si…
TI-2026-51009 CVE-2026-72783 · GHSA-7hxc-f267-h5q7
Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained
Priority LOW 30
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class.
TI-2026-51008 CVE-2026-72782 · GHSA-596p-6jv8-775v
Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak
Priority LOW 31
Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even wh…
TI-2026-51005 CVE-2026-72779 · GHSA-957r-qf9p-67xw
Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject
Priority LOW 38
Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability.
TI-2026-51004 CVE-2026-72778 · GHSA-265m-7826-wjqm
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config
Priority MEDIUM 41
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling.