Craftcms Cms
85 CVEs affecting Craftcms Cms. Latest disclosed: 2026-07-02. Critical: 7, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32432 | Critical | 10.0 | 2025-04-25 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-R… |
CVE-2023-41892 | Critical | 10.0 | 2023-09-13 | Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15… |
CVE-2026-32267 | Critical | 9.8 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-priv… |
CVE-2024-56145 | Critical | 9.8 | 2024-12-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerabi… |
CVE-2026-28783 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP func… |
CVE-2026-28697 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2026-31858 | High | 8.8 | 2026-03-11 | Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was added to ElementInd… |
CVE-2026-31857 | High | 8.8 | 2026-03-11 | Craft is a content management system (CMS). Prior to 5.9.9 and 4.17.4, a Remote Code Execution vulnerability exists in the Craft CMS 5 conditions system. The B… |
CVE-2026-25497 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalatio… |
CVE-2026-25495 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-element… |
CVE-2025-68454 | High | 8.8 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-54417 | High | 8.8 | 2025-08-09 | Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-2… |
CVE-2024-52291 | High | 8.4 | 2024-11-13 | Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file://… |
CVE-2025-23209 | High | 8.0 | 2025-01-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that… |
CVE-2024-52292 | High | 7.7 | 2024-11-13 | Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This f… |
CVE-2026-28696 | High | 7.5 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tag… |
CVE-2026-56382 | High | 7.2 | 2026-06-21 | Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCa… |
CVE-2026-33157 | High | 7.2 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, i… |
CVE-2026-32264 | High | 7.2 | 2026-03-16 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a… |