Security: craftcms/cms
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Missing authorization check allows non-admin control panel users access to user registration metricsGHSA-rvmm-v933-jgxq published
Jul 25, 2026 by angrybradModerate -
Missing authorization check allows non-admin control panel users to reorder Global SetsGHSA-9p7c-v5x3-rfx8 published
Jul 25, 2026 by angrybradLow -
Authenticated RCE via `condition.config` JSON cleanse bypassGHSA-265m-7826-wjqm published
Jul 25, 2026 by angrybradHigh -
Arbitrary file read via SplFileObject in non-sandboxed template contextsGHSA-957r-qf9p-67xw published
Jul 25, 2026 by angrybradLow -
Passkey login accepts replayed WebAuthn assertionsGHSA-wg23-69c2-gjc8 published
Jul 25, 2026 by angrybradModerate -
Authenticated RCE through Twig sandbox escapeGHSA-f5wm-88jv-g5hx published
Jul 25, 2026 by angrybradHigh -
Authenticated leak of secret environment variablesGHSA-596p-6jv8-775v published
Jul 25, 2026 by angrybradHigh -
Incorrect path validation could potentially lead to path traversalGHSA-7hxc-f267-h5q7 published
Jul 25, 2026 by angrybradLow -
SSRF in GQL asset mutation - incomplete IP denylist + post-fetch validationGHSA-2mx8-9ww7-p27x published
Jul 25, 2026 by angrybradModerate -
Authorization bypass: view-only Categories user can modify category structure via structures/move-elementGHSA-xxpx-f366-4xpq published
Jul 25, 2026 by angrybradModerate