What’s Vulnerable › Products

craftcms cms vulnerabilities

175 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 122 published in the last 12 months.

Check whether your craftcms cms version is affected

Exploited craftcms cms vulnerabilities

• CVE-2025-32432 — Craft CMS Code Injection Vulnerability
• CVE-2025-35939 — Craft CMS External Control of Assumed-Immutable Web Parameter Vulnerability
• CVE-2024-56145 — Craft CMS Code Injection Vulnerability
• CVE-2025-23209 — Craft CMS Code Injection Vulnerability

Latest craftcms cms vulnerabilities

• CVE-2026-115938 — Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE (CVSS 8.8)
• CVE-2026-115935 — Control panel only API response emulation replaces "securityKey" and reaches server RCE (CVSS 8.8)
• CVE-2026-112777 — Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE (CVSS 7.2)
• CVE-2026-112776 — Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations (CVSS 9.8)
• CVE-2026-112775 — Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password (CVSS 7.5)
• CVE-2026-112774 — Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout (CVSS 7.2)
• CVE-2026-112773 — Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection (CVSS 8.8)
• CVE-2026-112772 — Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection (CVSS 8.8)
• CVE-2026-112771 — Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters (CVSS 6.5)
• CVE-2026-112770 — Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable (CVSS 8.8)
• CVE-2026-109308 — Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection (CVSS 8.8)
• CVE-2026-109307 — Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification (CVSS 4.7)
• CVE-2026-109306 — Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition (CVSS 5.9)
• CVE-2026-109305 — Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every (CVSS 8.8)
• CVE-2026-109304 — Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument (CVSS 4.9)
• CVE-2026-105985 — Authenticated RCE via render-components Entry Type overrides (CVSS 8.8)
• CVE-2026-92594 — Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL (CVSS 7.5)
• CVE-2026-92593 — Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution (CVSS 8.8)
• CVE-2026-92592 — Craft CMS before 4.18.6 Remote Code Execution via signed cookie (CVSS 8.8)
• CVE-2026-92591 — Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer (CVSS 5.9)
• CVE-2026-92590 — Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields (CVSS 5.4)
• CVE-2026-92589 — Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder (CVSS 4.3)
• CVE-2026-79987 — Low-privilege RCE through element-search eager loading (CVSS 8.8)
• CVE-2026-86732 — Craft CMS before 5.10.12 Remote Code Execution via element-index (CVSS 8.8)
• CVE-2026-86731 — Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController (CVSS 6.5)