Craft CMS vulnerabilities
We track 90 vulnerabilities in Craft CMS products across 7 products. 89 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 9, 2026.
Latest Craft CMS vulnerabilities
- 7.2 High severity
cms: Improper Limitation of a Pathname to a Restricted Directory
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerabili
- 7.5 High severity
cms: Improper Authentication
Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that the attacker has knowle
- 7.5 High severity
Craft CMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selecte
- 8.8 High severity
cms: Improper Privilege Management
Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.
- 9.8 Critical severity
cms: Improper Control of Generation of Code
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in
- 7.2 High severity
cms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Althou
- 7.2 High severity
Craft CMS: Improper Control of Generation of Code
CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution. NOTE: the vendor d
- 7.2 High severity
cms: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote Code Execution. If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTempl
- 7.5 High severity
Craft CMS: Insufficiently Protected Credentials
All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to av
- 8.8 High severity
Craft CMS: Weak Password Recovery Mechanism for Forgotten Password
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionali