Edito vulnerabilities
We track 5 vulnerabilities in Edito products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Edito vulnerabilities
- 8.4 High severity
Edito CMS: Deserialization of Untrusted Data
Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the se
- 7.1 High severity
Edito CMS: Unrestricted Upload of File with Dangerous Type
Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for
- 7.1 High severity
Edito CMS: Improper Neutralization of Special Elements used in an Expression Language Statement
Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the atta
- 8.7 High severity
Edito CMS: Improper Verification of Cryptographic Signature
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obt
- 7.5 High severity
Edito CMS: Files or Directories Accessible to External Parties
Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates f