Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: craftcms cms 5.10.14 Clear all filters
TI-2026-71124 CVE-2026-109308 · GHSA-r8mr-vm79-xxh4

Craft CMS behavior injection enables remote code execution

Priority MEDIUM 40

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handl…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0049 Published 2026-10-12 Fixed in 4.18.7, 5.10.14 CWE-94
TI-2026-71123 CVE-2026-109307 · GHSA-c72m-w87q-gvqm

DOM-based XSS in Craft CMS login 2FA verification via returnUrl

Priority LOW 10

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-…

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00185 Published 2026-10-12 Fixed in 5.10.14 CWE-79
TI-2026-71122 CVE-2026-109306 · GHSA-g9xf-4797-9phm

Missing authorization in Craft CMS lets users downgrade site edition

Priority LOW 26

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00233 Published 2026-10-12 Fixed in 5.10.14 CWE-862
TI-2026-71121 CVE-2026-109305 · GHSA-xcjh-qqjq-gq4g

Twig sandbox bypass in Craft CMS allows code execution via has some

Priority MEDIUM 40

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00485 Published 2026-10-12 Fixed in 5.10.14 CWE-1336
TI-2026-71120 CVE-2026-109304 · GHSA-52mh-mf22-cc6j

Arbitrary file read in Craft CMS through Twig create() DOMDocument

Priority LOW 30

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00314 Published 2026-10-12 Fixed in 4.18.7, 5.10.14 CWE-200