Security: craftcms/cms
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Unauthorized Deletion of Destination Folders During Forced MovesGHSA-3w32-23wj-rxg3 published
May 29, 2026 by angrybradModerate -
Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsGHSA-x5m4-g2cq-52pq published
May 29, 2026 by angrybradHigh -
Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsGHSA-c55v-343g-5xff published
Jun 16, 2026 by angrybradModerate -
Sensitive File Disclosure / Server-Side File ReadGHSA-287w-mxq6-x2cp published
Jun 16, 2026 by angrybradModerate -
Authorization bypass in `entries/move-to-section` via missing target-section save checkGHSA-43cq-c2gq-pfpw published
May 29, 2026 by angrybradModerate -
Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gapGHSA-qq2c-2q8j-jh27 published
May 29, 2026 by angrybradModerate -
Potential authenticated Remote Code Execution via referrer redirectGHSA-f74w-488g-8x5r published
Jun 16, 2026 by angrybradHigh -
Potential authenticated Remote Code Execution via malicious attached BehaviorGHSA-qrgm-p9w5-rrfw published
Apr 27, 2026 by angrybradModerate -
Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII DisclosureGHSA-gj2p-p9m4-c8gw published
Apr 27, 2026 by angrybradModerate -
Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information DisclosureGHSA-33m5-hqp9-97pw published
Apr 27, 2026 by angrybradModerate