CmsEasy vulnerabilities
We track 7 vulnerabilities in CmsEasy products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on December 28, 2025.
Latest CmsEasy vulnerabilities
- 7.2 High severity
CmsEasy: Improper Control of Generation of Code
A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code in
- 8.1 High severity
CmsEasy: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in CmsEasy 7.7.7.9 and classified as problematic. Affected by this vulnerability is the function deleteimg_action in the library lib/admin/image_admin.php. The manipulation of the argument imgname leads to path traversal. The att
- 8.1 High severity
CmsEasy: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimg_action in the library lib/admin/file_admin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch th
- 7.5 High severity
cmseasy: Improper Limitation of a Pathname to a Restricted Directory
CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the file_get_contents function in the fckedit_action method of /admin/template_admin.php. This vulnerability allows attackers to read arbitrary files.
- 7.5 High severity
cmseasy: Path Traversal: '/dir/../filename'
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
- 9.8 Critical severity
CmsEasy: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. T
- 9.8 Critical severity
Cmseasy: Improper Limitation of a Pathname to a Restricted Directory
cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion.