Security: craftcms/cms
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Peer asset file overwrite via assets/replace-file late-discovered target skips permission checkGHSA-329j-cx85-8r56 published
Aug 18, 2026 by angrybradModerate -
Non-admin with administrateUsers permissions can mint an admin password reset URLGHSA-6qw4-cjqw-fj72 published
Aug 18, 2026 by angrybradHigh -
Missing volume permission in AssetsController::actionMoveInfo leaks cross-volume asset count and total sizeGHSA-5mjc-jqcw-6vrp published
Aug 18, 2026 by angrybradLow -
string-typed field-layout elements evade array-only cleanse, enabling behavior-injection RCEGHSA-qj4v-m29p-fj4m published
Aug 25, 2026 by angrybradHigh -
Missing admin-target guard in UsersController::actionActivateUser can lead to permission escalationGHSA-jqf5-vfg6-8cx5 published
Aug 25, 2026 by angrybradModerate -
Remote Code Execution by non-admin authenticated userGHSA-9wcj-wqqh-cqvg published
Aug 25, 2026 by angrybradHigh -
DOM XSS via GitHub issue title in CraftSupport widgetGHSA-24x4-j6x9-rfw5 published
Jun 16, 2026 by angrybradHigh -
Stored XSS via Structure entry title in table viewGHSA-xrqc-p465-2xvg published
Jun 16, 2026 by angrybradModerate -
Missing peer-permission check in "AssetsController::actionDeleteFolder" allows deletion of other users' assetsGHSA-7h62-6v23-v8fm published
May 29, 2026 by angrybradModerate -
Unauthorized Deletion of Source Assets During File ReplacementGHSA-qh45-9g5p-m2v4 published
May 29, 2026 by angrybradModerate