PHP package security
Is craftcms/cms vulnerable?
127 known security advisories for craftcms/cms. The latest was reported on 2026-08-07 and is fixed in 5.10.5. The newest release, 5.12.0, is not affected by any of them.
9 critical 41 high 65 medium 12 low
- Known advisories
- 127
- Newest release
- 5.12.0
- Released
- 2026-11-03
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for craftcms/cms
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-07 | Craft CMS: Passkey login accepts replayed WebAuthn assertions GHSA-wg23-69c2-gjc8 · GitHub | critical | >=5.0.0-RC1,<5.10.5 | 5.10.5 |
| 2026-08-06 | Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts GHSA-957r-qf9p-67xw · CVE-2026-72779 · GitHub | medium | >=4.0.0-RC1,<4.18.2 | >=5.0.0-RC1,<5.10.6 | 4.18.2, 5.10.6 |
| 2026-08-06 | Craft CMS: Authenticated leak of secret environment variables GHSA-596p-6jv8-775v · CVE-2026-72782 · GitHub | medium | >=4.0.0-RC1,<4.18.2 | >=5.0.0-RC1,<5.10.6 | 4.18.2, 5.10.6 |
| 2026-08-06 | Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element GHSA-xxpx-f366-4xpq · CVE-2026-72785 · GitHub | medium | >=5.0.0-RC1,<5.10.6 | 5.10.6 |
| 2026-08-06 | Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics GHSA-rvmm-v933-jgxq · CVE-2026-14794 · GitHub | medium | >=5.0.0-RC1,<5.10.3 | >=4.0.0-RC1,<4.18.1 | 4.18.1, 5.10.3 |
| 2026-08-06 | Craft CMS: Incorrect path validation could potentially lead to path traversal GHSA-7hxc-f267-h5q7 · CVE-2026-72783 · GitHub | low | >=4.0.0-RC1,<4.18.2 | >=5.0.0-RC1,<5.10.6 | 4.18.2, 5.10.6 |
| 2026-08-06 | Craft CMS: Stored XSS in the control panel via unescaped draft name GHSA-2rp4-x2j7-qmcc · GitHub | medium | >=5.0.0-RC1,<5.10.8 | 5.10.8 |
| 2026-08-06 | Craft CMS: Arbitrary user password reset leading to administrator account takeover GHSA-p8x7-9vfw-p7vc · GitHub | high | >=5.0.0-RC1,<5.10.8 | 5.10.8 |
| 2026-08-06 | Craft CMS: Authenticated RCE through Twig sandbox escape GHSA-f5wm-88jv-g5hx · CVE-2026-72781 · GitHub | high | >=4.0.0-RC1,<4.18.3 | >=5.0.0-RC1,<5.10.7 | 4.18.3, 5.10.7 |
| 2026-08-06 | Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets GHSA-9p7c-v5x3-rfx8 · CVE-2026-14793 · GitHub | medium | >=5.0.0-RC1,<5.10.3 | >=4.0.0-RC1,<4.18.1 | 4.18.1, 5.10.3 |
| 2026-08-06 | Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass GHSA-265m-7826-wjqm · CVE-2026-72778 · GitHub | high | >=4.0.0-RC1,<4.18.2 | >=5.0.0-RC1,<5.10.6 | 4.18.2, 5.10.6 |
| 2026-07-09 | Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview GHSA-86vw-x4ww-x467 · CVE-2026-56382 · GitHub | high | >=5.5.0,<=5.9.13 | not stated |
| 2026-07-09 | Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read GHSA-c43v-4cr8-6mvp · CVE-2026-56394 · GitHub | low | >=5.0.0-RC1,<=5.9.12 | >=4.0.0-RC1,<=4.17.6 | not stated |
| 2026-07-06 | Craft CMS: Potential authenticated Remote Code Execution via referrer redirect GHSA-f74w-488g-8x5r · CVE-2026-55794 · GitHub | high | >=5.9.0,<5.10.0 | 5.10.0 |
| 2026-07-06 | Craft CMS: Stored XSS via Structure entry title in table view GHSA-xrqc-p465-2xvg · CVE-2026-55793 · GitHub | medium | >=5.0.0-RC1,<5.9.22 | 5.9.22 |
| 2026-07-06 | Craft CMS: Sensitive File Disclosure / Server-Side File Read GHSA-287w-mxq6-x2cp · CVE-2026-55792 · GitHub | medium | >=5.0.0-RC1,<5.10.0 | >=4.0.0-RC1,<4.18.0 | 4.18.0, 5.10.0 |
| 2026-07-06 | Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget GHSA-24x4-j6x9-rfw5 · CVE-2026-55790 · GitHub | high | >=4.0.0-RC1,<4.17.15 | >=5.0.0-RC1,<5.9.22 | 4.17.15, 5.9.22 |
| 2026-07-06 | Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission GHSA-x76w-8c62-48mg · CVE-2026-56384 · GitHub | medium | >=5.0.0-RC1,<=5.9.13 | >=4.0.0-RC1,<=4.17.7 | not stated |
| 2026-07-02 | Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves GHSA-3w32-23wj-rxg3 · CVE-2026-50282 · GitHub | high | >=4.0.0-RC1,<4.17.14 | >=5.0.0-RC1,<5.9.21 | 4.17.14, 5.9.21 |
| 2026-07-02 | Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements GHSA-x5m4-g2cq-52pq · CVE-2026-50281 · GitHub | high | >=5.7.0,<5.9.21 | 5.9.21 |
| 2026-07-02 | Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets GHSA-7h62-6v23-v8fm · CVE-2026-50284 · GitHub | high | >=4.0.0-RC1,<4.17.15 | >=5.0.0-RC1,<5.9.22 | 4.17.15, 5.9.22 |
| 2026-07-02 | Craft CMS: Unauthorized Deletion of Source Assets During File Replacement GHSA-qh45-9g5p-m2v4 · CVE-2026-50283 · GitHub | medium | >=4.0.0-RC1,<4.17.14 | >=5.0.0-RC1,<5.9.21 | 4.17.14, 5.9.21 |
| 2026-07-02 | Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check GHSA-43cq-c2gq-pfpw · CVE-2026-50280 · GitHub | medium | >=5.0.0-RC1,<5.9.21 | 5.9.21 |
| 2026-07-02 | Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap GHSA-qq2c-2q8j-jh27 · CVE-2026-50279 · GitHub | high | >=5.0.0-RC1,<5.9.21 | 5.9.21 |
| 2026-06-19 | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs GHSA-c55v-343g-5xff · CVE-2026-55791 · GitHub | critical | >=4.0.0-RC1,<4.18 | >=5.0.0-RC1,<5.10 | 4.18, 5.10 |
| 2026-05-06 | Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure GHSA-33m5-hqp9-97pw · CVE-2026-44012 · GitHub | high | >=5.0.0-RC1,<5.9.18 | 5.9.18 |
| 2026-05-06 | Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior GHSA-qrgm-p9w5-rrfw · CVE-2026-44011 · GitHub | high | >=5.0.0,<5.9.18 | >=4.0.0,<4.17.12 | 4.17.12, 5.9.18 |
| 2026-05-06 | Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure GHSA-gj2p-p9m4-c8gw · CVE-2026-44010 · GitHub | high | >=4.0.0,<4.17.12 | >=5.0.0,<5.9.18 | 4.17.12, 5.9.18 |
| 2026-04-14 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint GHSA-95wr-3f2v-v2wh · CVE-2026-41130 · GitHub | medium | >=4.0.0-RC1,<=4.17.8 | >=5.0.0-RC1,<=5.9.14 | not stated |
| 2026-04-14 | Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations GHSA-3m9m-24vh-39wx · CVE-2026-41129 · GitHub | medium | >=4.0.0-RC1,<=4.17.8 | >=5.0.0-RC1,<=5.9.14 | not stated |
| 2026-04-14 | Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action GHSA-jq2f-59pj-p3m3 · CVE-2026-41128 · GitHub | medium | >=5.6.0,<5.9.15 | 5.9.15 |
| 2026-03-26 | Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata GHSA-44px-qjjc-xrhq · CVE-2026-56385 · GitHub | low | >=4.0.0-RC1,<=4.17.7 | >=5.0.0-RC1,<=5.9.13 | not stated |
| 2026-03-24 | Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions GHSA-f582-6gf6-gx4g · CVE-2026-33162 · GitHub | medium | >=5.3.0,<=5.9.13 | not stated |
| 2026-03-24 | Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users GHSA-vgjg-248p-rfm2 · CVE-2026-33161 · GitHub | low | >=4.0.0-RC1,<=4.17.7 | >=5.0.0-RC1,<=5.9.13 | not stated |
| 2026-03-24 | Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL GHSA-5pgf-h923-m958 · CVE-2026-33160 · GitHub | low | >=4.0.0-RC1,<=4.17.7 | >=5.0.0-RC1,<=5.9.13 | not stated |
| 2026-03-24 | Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations GHSA-6mrr-q3pj-h53w · CVE-2026-33159 · GitHub | medium | >=4.0.0-RC1,<=4.17.7 | >=5.0.0-RC1,<=5.9.13 | not stated |
| 2026-03-24 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) GHSA-3pvf-vxrv-hh9c · CVE-2026-33158 · GitHub | medium | >=5.0.0-RC1,<=5.9.13 | >=4.0.0-RC1,<=4.17.7 | not stated |
| 2026-03-24 | Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior GHSA-2fph-6v5w-89hh · CVE-2026-33157 · GitHub | high | >=5.6.0,<=5.9.12 | not stated |
| 2026-03-18 | Craft CMS Vulnerable to Stored XSS in Revision Context Menu GHSA-3x4w-mxpf-fhqq · CVE-2026-33051 · GitHub | medium | >=5.9.0-beta.1,<=5.9.10 | not stated |
| 2026-03-16 | Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() GHSA-cc7p-2j3x-x7xf · CVE-2026-32267 · GitHub | high | >=5.0.0-RC1,<=5.9.11 | >=4.0.0-RC1,<=4.17.5 | not stated |
| 2026-03-16 | Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController GHSA-4484-8v2f-5748 · CVE-2026-32264 · GitHub | high | >=5.0.0-RC1,<=5.9.10 | >=4.0.0-RC1,<=4.17.4 | not stated |
| 2026-03-16 | Craft CMS vulnerable to behavior injection RCE via EntryTypesController GHSA-qx2q-q59v-wf3j · CVE-2026-32263 · GitHub | high | >=5.6.0,<=5.9.10 | not stated |
| 2026-03-16 | Craft CMS has a Path Traversal Vulnerability in AssetsController GHSA-472v-j2g4-g9h2 · CVE-2026-32262 · GitHub | medium | >=5.0.0-RC1,<=5.9.10 | >=4.0.0-RC1,<=4.17.4 | not stated |
| 2026-03-11 | Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page GHSA-g3hp-vvqf-8vw6 · CVE-2026-56381 · GitHub | low | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-03-11 | CraftCMS has an RCE vulnerability via relational conditionals in the control panel GHSA-fp5j-j7j4-mcxc · CVE-2026-31857 · GitHub | high | >=4.0.0-beta.1,<=4.17.3 | >=5.0.0-RC1,<=5.9.8 | not stated |
| 2026-03-11 | CraftCMS's `ElementSearchController` Affected by Blind SQL Injection GHSA-g7j6-fmwx-7vp8 · CVE-2026-31858 · GitHub | high | >=5.0.0-RC1,<=5.9.8 | not stated |
| 2026-03-11 | CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization GHSA-fvwq-45qv-xvhv · CVE-2026-31859 · GitHub | medium | >=5.7.5,<=5.9.6 | >=4.15.3,<=4.17.2 | not stated |
| 2026-03-10 | Craft CMS has a potential information disclosure vulnerability in preview tokens GHSA-vg3j-hpm9-8v5v · CVE-2026-29113 · GitHub | low | >=5.0.0-RC1,<5.9.7 | >=4.0.0-RC1,<4.17.3 | 4.17.3, 5.9.7 |
| 2026-03-04 | Craft CMS has unauthenticated activation email trigger with potential user enumeration GHSA-234q-vvw3-mrfq · CVE-2026-29069 · GitHub | high | >=4.0.0-RC1,<4.17.0-beta.2 | >=5.0.0-RC1,<5.9.0-beta.2 | 4.17.0-beta.2, 5.9.0-beta.2 |
| 2026-03-03 | Craft CMS has potential authenticated Remote Code Execution via Twig SSTI GHSA-qc86-q28f-ggww · CVE-2026-28784 · GitHub | medium | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action GHSA-jxm3-pmm2-9gf6 · CVE-2026-28782 · GitHub | medium | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS has Twig Function Blocklist Bypass GHSA-5fvc-7894-ghp4 · CVE-2026-28783 · GitHub | medium | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS: Entries Authorship Spoofing via Mass Assignment GHSA-2xfc-g69j-x2mp · CVE-2026-28781 · GitHub | medium | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates GHSA-v47q-jxvr-p68x · CVE-2026-28697 · GitHub | critical | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options GHSA-4mgv-366x-qxvx · CVE-2026-56393 · GitHub | low | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS has IDOR via GraphQL @parseRefs GHSA-7x43-mpfg-r9wj · CVE-2026-28696 · GitHub | high | >=5.0.0-RC1,<5.9.0-beta.1 | >=4.0.0-RC1,<4.17.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-03-03 | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget GHSA-94rc-cqvm-m4pw · CVE-2026-28695 · GitHub | medium | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.8.7,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-02-25 | Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type GHSA-6j87-m5qx-9fqp · CVE-2026-56383 · GitHub | low | >=5.0.0-RC1,<=5.8.22 | >=4.5.0-beta.1,<=4.16.18 | not stated |
| 2026-02-24 | Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution GHSA-v2gc-rm6g-wrw9 · CVE-2026-27129 · GitHub | medium | >=3.5.0,<=4.16.18 | >=5.0.0-RC1,<=5.8.22 | not stated |
| 2026-02-23 | Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit GHSA-6fx5-5cw5-4897 · CVE-2026-27128 · GitHub | medium | >=5.0.0-RC1,<=5.8.22 | >=4.5.0-RC1,<=4.16.18 | not stated |
| 2026-02-23 | Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding GHSA-gp2f-7wcm-5fhx · CVE-2026-27127 · GitHub | high | >=3.5.0,<=4.16.18 | >=5.0.0-RC1,<=5.8.22 | not stated |
| 2026-02-23 | Craft CMS has Stored XSS in Table Field via "HTML" Column Type GHSA-3jh3-prx3-w6wc · CVE-2026-27126 · GitHub | medium | >=5.0.0-RC1,<=5.8.22 | >=4.5.0-RC1,<=4.16.18 | not stated |
| 2026-02-09 | Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior GHSA-7jx7-3846-m7w7 · CVE-2026-25498 · GitHub | high | >=4.0.0-RC1,<=4.16.17 | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-02-09 | Craft CMS: GraphQL Asset Mutation Privilege Escalation GHSA-fxp3-g6gw-4r4v · CVE-2026-25497 · GitHub | high | >=4.0.0-RC1,<4.17.0-beta.1 | >=5.0.0-RC1,<5.9.0-beta.1 | 4.17.0-beta.1, 5.9.0-beta.1 |
| 2026-02-09 | Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields GHSA-9f5h-mmq6-2x78 · CVE-2026-25496 · GitHub | medium | >=4.0.0-RC1,<=4.16.17 | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-02-09 | Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` GHSA-2453-mppf-46cj · CVE-2026-25495 · GitHub | high | >=4.0.0-RC1,<=4.16.17 | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-02-09 | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation GHSA-m5r2-8p9x-hp5m · CVE-2026-25494 · GitHub | medium | >=4.0.0-RC1,<=4.16.17 | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-02-09 | Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect GHSA-8jr8-7hr4-vhfx · CVE-2026-25493 · GitHub | medium | >=4.0.0-RC1,<=4.16.17 | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-02-09 | Craft CMS Vulnerable to Stored XSS in Entry Types Name GHSA-7pr4-wx9w-mqwr · CVE-2026-25491 · GitHub | low | >=5.0.0-RC1,<=5.8.21 | not stated |
| 2026-01-05 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior GHSA-255j-qw47-wjh5 · CVE-2025-68455 · GitHub | high | >=4.0.0-RC1,<=4.16.16 | >=5.0.0-RC1,<=5.8.20 | not stated |
| 2026-01-05 | Unauthenticated Craft CMS users can trigger a database backup GHSA-v64r-7wg9-23pr · CVE-2025-68456 · GitHub | high | >=3.0.0,<=4.16.16 | >=5.0.0-RC1,<=5.8.20 | not stated |
| 2026-01-05 | Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI GHSA-742x-x762-7383 · CVE-2025-68454 · GitHub | medium | >=4.0.0-RC1,<=4.16.16 | >=5.0.0-RC1,<=5.8.20 | not stated |
| 2026-01-05 | Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation GHSA-x27p-wfqw-hfcc · CVE-2025-68437 · GitHub | medium | >=3.5.0,<=4.16.16 | >=5.0.0-RC1,<=5.8.20 | not stated |
| 2026-01-05 | Craft CMS vulnerable to potential information disclosure via unchecked asset relocation GHSA-53vf-c43h-j2x9 · CVE-2025-68436 · GitHub | medium | >=4.0.0-RC1,<=4.16.16 | >=5.0.0-RC1,<=5.8.20 | not stated |
| 2025-08-25 | Craft CMS Potential Remote Code Execution via Twig SSTI GHSA-crcq-738g-pqvc · CVE-2025-57811 · GitHub | medium | >=5.0.0-RC1,<=5.8.6 | >=4.0.0-RC1,<=4.16.5 | not stated |
| 2025-08-08 | Craft CMS has a theoretical bypass for CVE-2025-23209 GHSA-2vcf-qxv3-2mgw · CVE-2025-54417 · GitHub | medium | >=5.5.8,<5.8.4 | >=4.13.8,<4.16.3 | 4.16.3, 5.8.4 |
| 2025-05-08 | Craft CMS stores arbitrary content provided by unauthenticated users in session files GHSA-7vrx-9684-xrf2 · CVE-2025-35939 · GitHub | medium | <4.15.3 | >=5.0.0-alpha.1,<5.7.5 | 4.15.3, 5.7.5 |
| 2025-05-05 | Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI GHSA-7c58-g782-9j38 · CVE-2025-46731 · GitHub | high | >=5.0.0-RC1,<=5.6.14 | >=4.0.0-RC1,<=4.14.12 | not stated |
| 2025-04-25 | Craft CMS Allows Remote Code Execution GHSA-f3gw-9ww9-jmc3 · CVE-2025-32432 · GitHub | critical | >=5.0.0-RC1,<=5.6.16 | >=4.0.0-RC1,<=4.14.14 | >=3.0.0-RC1,<=3.9.14 | not stated |
| 2025-01-21 | Craft CMS has a potential RCE with a compromised security key GHSA-x684-96hh-833x · CVE-2025-23209 · GitHub | high | >=4.0.0-RC1,<4.13.8 | >=5.0.0-RC1,<5.5.5 | 4.13.8, 5.5.5 |
| 2024-12-18 | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled GHSA-2p6p-9rc9-62j9 · CVE-2024-56145 · GitHub | critical | >=3.0.0,<3.9.14 | >=4.0.0-RC1,<4.13.2 | >=5.0.0-RC1,<5.5.2 | 3.9.14, 4.13.2, 5.5.2 |
| 2024-11-13 | Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI GHSA-f3cw-hg6r-chfv · CVE-2024-52293 · GitHub | high | >=5.0.0-RC1,<=5.4.2 | >=4.0.0-RC1,<=4.12.1 | not stated |
| 2024-11-13 | Craft CMS Arbitrary System File Read GHSA-cw6g-qmjq-6w2w · CVE-2024-52292 · GitHub | high | >=3.5.13,<=4.12.6.1 | >=5.0.0-alpha.1,<=5.4.7.1 | not stated |
| 2024-11-13 | Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution GHSA-jrh5-vhr9-qh7q · CVE-2024-52291 · GitHub | high | >=4.0.0-RC1,<=4.12.4.1 | >=5.0.0-RC1,<=5.4.5.1 | not stated |
| 2024-09-09 | Craft CMS vulnerable to stored XSS in breadcrumb list and title fields GHSA-28h4-788g-rh42 · CVE-2024-45406 · GitHub | medium | >=5.0.0,<5.1.2 | 5.1.2 |
| 2024-07-25 | Craft CMS Allows TOTP Token To Stay Valid After Use GHSA-wmx7-pw49-88jx · CVE-2024-41800 · GitHub | medium | >=5.0.0-beta.1,<=5.2.2 | not stated |
| 2024-06-25 | Craft CMS SQL injection vulnerability via the GraphQL API endpoint GHSA-hq4f-mv3q-8wcv · CVE-2024-37843 · GitHub | critical | <=3.7.31 | not stated |
| 2024-01-30 | Craft CMS Feed-Me GHSA-6p78-f7h9-6838 · CVE-2023-36260 · GitHub | high | <4.6.2 | 4.6.2 |
| 2024-01-03 | Craft CMS Privilege Escalation GHSA-j5g9-j7r4-6qvx · CVE-2024-21622 · GitHub | medium | >=3.0.0,<=3.9.5 | >=4.0.0-RC1,<=4.5.10 | not stated |
| 2023-09-13 | Craft CMS Remote Code Execution vulnerability GHSA-4w8r-3xrw-v25g · CVE-2023-41892 · GitHub | critical | >=4.0.0-RC1,<=4.4.14 | not stated |
| 2023-08-21 | Craft CMS vulnerable to Remote Code Execution via validatePath bypass GHSA-44wr-rmwq-3phw · CVE-2023-40035 · GitHub | high | >=3.0.0,<=3.8.14 | >=4.0.0-RC1,<=4.4.14 | not stated |
| 2023-06-20 | Craft CMS vulnerable to HTML injection GHSA-m3v5-gjj9-rg24 · CVE-2023-33495 · GitHub | medium | <=4.4.9 | not stated |
| 2023-05-26 | Stored cross site scripting in Craft CMS GHSA-7x94-jx75-3gh6 · CVE-2023-2817 · GitHub | medium | >=4.0.0-RC1,<4.4.12 | 4.4.12 |
| 2023-05-26 | Craft CMS stored XSS in indexedVolumes GHSA-6qjx-787v-6pxr · CVE-2023-33197 · GitHub | medium | >=4.0.0-RC1,<=4.4.5 | not stated |
| 2023-05-26 | Craft CMS stored XSS in review volume GHSA-cjmm-x9x9-m2w5 · CVE-2023-33196 · GitHub | medium | >=4.0.0-RC1,<=4.4.6 | not stated |
| 2023-05-26 | Craft CMS XSS in RSS widget feed GHSA-qpgm-gjgf-8c2x · CVE-2023-33195 · GitHub | medium | >=4.3.0,<=4.4.5 | not stated |
| 2023-05-26 | CraftCMS stored XSS in Quick Post widget error message GHSA-3wxg-w96j-8hq9 · CVE-2023-33194 · GitHub | low | >=3.0.0,<=3.8.5 | >=4.0.0-RC1,<4.4.6 | 4.4.6 |
| 2023-05-22 | Craft CMS vulnerable to Remote Code Execution via unrestricted file extension GHSA-vqxf-r9ph-cc9c · CVE-2023-32679 · GitHub | high | >=4.0.0,<4.4.6 | 4.4.6 |
| 2023-05-12 | CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter GHSA-fjx5-xm7q-whvj · CVE-2023-30130 · GitHub | high | <=3.8.1 | not stated |
| 2023-05-05 | craftcms/cms vulnerable to cross site scripting in RSS feed widget GHSA-j4mx-98hw-6rv6 · CVE-2023-31144 · GitHub | medium | >=4.0.0,<=4.4.3 | >=3.0.0,<=3.8.3 | not stated |
| 2023-04-25 | Cross Site Scripting in CraftCMS GHSA-wv7j-rc2q-9j67 · CVE-2023-30177 · GitHub | medium | <3.7.68 | 3.7.68 |
| 2023-03-03 | Craft CMS Stored Cross-site Scripting Injection Vulnerability GHSA-qcrj-6ffc-v7hq · CVE-2023-23927 · GitHub | medium | >=3.7.24,<3.7.64 | >=4.0.0-RC1,<4.3.7 | 3.7.64, 4.3.7 |
| 2022-12-05 | Craft CMS discloses password hashes GHSA-h972-v458-m892 · CVE-2022-37783 · GitHub | high | >=3.0.0,<=3.7.32 | not stated |
| 2022-09-22 | Craft CMS Cross-site Scripting vulnerability GHSA-f546-v666-559x · CVE-2022-37246 · GitHub | medium | >=3.7.39,<3.7.51 | >=4.0.0-RC1,<4.2.1 | 3.7.51, 4.2.1 |
| 2022-09-17 | Craft CMS Stored Cross-site Scripting in User Addresses Title GHSA-8r89-x93x-mjq2 · CVE-2022-37250 · GitHub | medium | >=4.0.0-RC1,<4.2.1 | 4.2.1 |
| 2022-09-17 | Craft CMS Cross site Scripting vulnerability GHSA-wxvf-839f-jqmh · CVE-2022-37248 · GitHub | medium | >=4.0.0-RC1,<4.2.1 | 4.2.1 |
| 2022-09-17 | Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page GHSA-3cvm-7wrh-qrf9 · CVE-2022-37247 · GitHub | medium | >=4.0.0-RC1,<4.2.1 | 4.2.1 |
| 2022-09-17 | Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts GHSA-mw37-wx8p-gp45 · CVE-2022-37251 · GitHub | medium | >=4.0.0-RC1,<4.2.1 | >=3.7.0-beta.1,<3.7.55.2 | 3.7.55.2, 4.2.1 |
| 2022-05-24 | Craft CMS Cross-site Scripting Vulnerability GHSA-33jj-92px-m4g7 · CVE-2020-19626 · GitHub | medium | <3.1.33 | 3.1.33 |
| 2022-05-24 | Craft CMS possibility of brute force attempts GHSA-wvr4-w6cw-4px8 · CVE-2019-15929 · GitHub | critical | <3.1.7 | 3.1.7 |
| 2022-05-24 | Craft CMS XSS Vulnerability GHSA-f3xr-q258-h7m9 · CVE-2019-17496 · GitHub | medium | <3.3.8 | 3.3.8 |
| 2022-05-24 | Craft CMS XSS Vulnerability GHSA-w5q4-q7wp-qww6 · CVE-2019-12823 · GitHub | medium | <3.1.31 | 3.1.31 |
| 2022-05-17 | Craft CMS XSS Vulnerability GHSA-xv5f-2997-qhrq · CVE-2017-8052 · GitHub | medium | <2.6.2974 | 2.6.2974 |
| 2022-05-17 | Craft CMS XSS Vulnerability GHSA-9mcw-mwxv-grwj · CVE-2017-8384 · GitHub | medium | <2.6.2976 | 2.6.2976 |
| 2022-05-17 | Craft CMS subject to URL forgery GHSA-j27g-r58q-624w · CVE-2017-8385 · GitHub | medium | <2.6.2976 | 2.6.2976 |
| 2022-05-17 | Craft CMS XSS Vulnerability GHSA-6pvw-hh48-jx7p · CVE-2017-9516 · GitHub | medium | <2.6.2982 | 2.6.2982 |
| 2022-05-14 | Craft CMS Cross-site Scripting (XSS) Vulnerability GHSA-72pf-cvwq-vgqg · CVE-2018-20418 · GitHub | medium | <=3.0.25 | not stated |
| 2022-05-13 | Craft CMS Vulnerable to Server-Side Template Injection GHSA-j7fx-v37j-v3w7 · CVE-2018-20465 · GitHub | high | <=3.0.34 | not stated |
| 2022-05-13 | Craft CMS Unauthorized View GHSA-7qq6-fgpw-xw45 · CVE-2017-8383 · GitHub | medium | <2.6.2976 | 2.6.2976 |
| 2022-05-13 | Craft CMS PHP Code Injection Vulnerability GHSA-r342-vjc4-wrmj · CVE-2018-3814 · GitHub | high | <=2.6.3000 | not stated |
| 2022-05-10 | Improper account password reset in Craft CMS GHSA-5cjr-78cq-3wrg · CVE-2022-29933 · GitHub | high | <3.7.36 | 3.7.36 |
| 2022-04-05 | XSS Injection Vulnerability GHSA-wf98-vxv9-jqfv · GitHub | low | <3.7.29 | 3.7.29 |
| 2022-04-04 | Cross-site Scripting in craftcms/cms GHSA-7xj5-fwqr-5378 · CVE-2022-28378 · GitHub | medium | <3.7.29 | 3.7.29 |
| 2022-03-18 | Craft CMS Cross-site Scripting Vulnerability GHSA-h2rj-8wgg-mm43 · CVE-2021-32470 · GitHub | medium | <3.6.13 | 3.6.13 |
| 2021-10-18 | CSV Injection Vulnerability GHSA-h7vq-5qgw-jwwq · CVE-2021-41824 · GitHub | high | >=3.4.0,<3.7.14 | 3.7.14 |
| 2021-07-02 | Craft CMS Remote Code Injection GHSA-x2j7-6hxm-87p3 · CVE-2021-27903 · GitHub | critical | <3.6.7 | 3.6.7 |
| 2021-07-02 | Craft CMS Cross-site Scripting Vulnerability GHSA-3jxh-789f-p7m6 · CVE-2021-27902 · GitHub | medium | <3.6.0 | 3.6.0 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about craftcms/cms
Does craftcms/cms have known vulnerabilities?
Yes. Packagist lists 127 security advisories for craftcms/cms (9 critical, 41 high, 65 medium, 12 low severity). The most recent, reported 2026-08-07, is "Craft CMS: Passkey login accepts replayed WebAuthn assertions". The newest release, 5.12.0, is outside every affected range.
Which version of craftcms/cms should I run?
The newest stable release is 5.12.0 (published 2026-11-03). The most recent advisory is fixed in 5.10.5, so stay on or above the fixed version for your major version. Run composer update craftcms/cms, then composer audit to confirm nothing else is flagged.
How do I check if my craftcms/cms version is affected?
Run composer show craftcms/cms in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.