p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de craftcms/cms

Vulnerabilidades publicadas para craftcms/cms en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 127

  1. CVE-2026-72787

    Media · CVSS 5.1EPSS 0,26%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

    Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of any higher-privileged user viewing the affected element, allowing account creation and other authenticated actions.

    craftcms/cmsPHP
    • Actualiza a 5.10.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-72786

    Alta · CVSS 7.1EPSS 0,46%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset

    Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

    craftcms/cmsPHP
    • Actualiza a 5.10.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-72785

    Crítica · CVSS 9.3EPSS 0,27%Corrección disponible

    Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

    Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its

    craftcms/cmsPHP
    • Actualiza a 5.10.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-72783

    Media · CVSS 6.9EPSS 0,2%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

    Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior validation assumptions (a desanitization-style issue) and potentially resolve to files outside the intended volume directory. The vendor notes the issue is not directly exploitable and no exploitable scenario has been discovered; the fix is recommended for hardening.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.2
    • Actualiza a 5.10.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-72782

    Alta · CVSS 7.1EPSS 0,39%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

    Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.2
    • Actualiza a 5.10.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-72781

    Alta · CVSS 8.7EPSS 0,79%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

    Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to access the control panel can render a malicious Twig template that abuses the yii\base\Component arbitrary function-call gadget to execute arbitrary code, even when the Twig sandbox is enabled via enableTwigSandbox().

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.3
    • Actualiza a 5.10.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-72780

    Alta · CVSS 7.1EPSS 0,39%Corrección disponible

    Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey

    Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts.

    craftcms/cmsPHP
    • Actualiza a 5.10.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-72779

    Alta · CVSS 8.7EPSS 0,38%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject

    Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator (with allowAdminChanges=true) to configure a malicious entry type title or URI format that instantiates SplFileObject in a non-sandboxed template context. When a user subsequently creates an entry in the affected section, arbitrary files on the server (such as .env containing the security key and database credentials) are read and rendered as entry titles.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.2
    • Actualiza a 5.10.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-72778

    Alta · CVSS 8.7EPSS 0,8%Corrección disponible

    Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

    Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig(), but Conditions::createCondition() later decodes and merges the JSON string in condition.config without re-running cleanseConfig() on the decoded configuration. Because condition.config is a JSON string during the first cleanse, Yii special config keys such as 'as ...' and 'on ...' can be hidden inside it and, after JSON decoding, are interpreted by Yii as be

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.2
    • Actualiza a 5.10.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2026-14794

    Media · CVSS 5.3EPSS 0,39%Corrección disponible

    Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization

    A flaw has been found in Craft CMS up to 4.18.0.1. Affected by this vulnerability is the function actionGetNewUsersData of the file src/controllers/ChartsController.php of the component Charts Endpoint. This manipulation of the argument userGroupId causes improper authorization. The attack is possible to be carried out remotely. Upgrading to version 4.18.1 addresses this issue. Patch name: 9ee53efc1314e6aba32771c66a13e072a246f4ce. It is suggested to upgrade the affected component.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.1
    • Actualiza a 5.10.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2026-14793

    Media · CVSS 5.3EPSS 0,39%Corrección disponible

    Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization

    A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the component reorder-sets Endpoint. The manipulation results in authorization bypass. The attack can be executed remotely. Upgrading to version 4.18.1 is able to address this issue. The patch is identified as 9bd05c91e6a7e6da5e949ec41a31c220c059aa04. The affected component should be upgraded.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.1
    • Actualiza a 5.10.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-50282

    Media · CVSS 4.9EPSS 0,35%Corrección disponible

    Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves

    Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.17.14
    • Actualiza a 5.9.21
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2026-50281

    Alta · CVSS 7.1EPSS 0,43%Corrección disponible

    Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

    Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes the attacker's attributes into the victim's existing entry row. ElementsController::beforeAction() pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level, actionBulkDuplicate(), reads a separate newAttributes

    craftcms/cmsPHP
    • Actualiza a 5.9.21
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-50280

    Media · CVSS 6EPSS 0,4%Corrección disponible

    Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

    Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limit

    craftcms/cmsPHP
    • Actualiza a 5.9.21
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-50279

    Alta · CVSS 7.6EPSS 0,36%Corrección disponible

    Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

    Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permis

    craftcms/cmsPHP
    • Actualiza a 5.9.21
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-55794

    Alta · CVSS 8.7EPSS 0,41%Corrección disponible

    Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

    Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control. Thi

    craftcms/cmsPHP
    • Actualiza a 5.10.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-55792

    Media · CVSS 6EPSS 0,4%Corrección disponible

    Craft CMS: Sensitive File Disclosure / Server-Side File Read

    Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataU

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18.0
    • Actualiza a 5.10.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-55791

    Media · CVSS 6.9EPSS 0,46%Corrección disponible

    Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

    Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: applicatio

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.18
    • Actualiza a 5.10
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-55790

    Alta · CVSS 7.4EPSS 0,46%Corrección disponible

    Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

    Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session. No control panel account or elevated privileges are required on the attacker’s side. This issue has been fixed in versions 4.17.16 and 5.9.23.

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.17.16
    • Actualiza a 5.9.23
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-50284

    Alta · CVSS 7.1EPSS 0,39%Corrección disponible

    Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

    Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that

    craftcms/cms craftcms/cmsPHP
    • Actualiza a 4.17.15
    • Actualiza a 5.9.22
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →