Craftcms/cms

This hub aggregates every CVE we track for Craftcms/cms, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Craftcms/cms.

• GHSA-wg23-69c2-gjc8Craft CMS: Passkey login accepts replayed WebAuthn assertionsAug 7, 2026
• GHSA-957r-qf9p-67xwCraft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contextsAug 6, 2026
• GHSA-596p-6jv8-775vCraft CMS: Authenticated leak of secret environment variablesAug 6, 2026
• GHSA-xxpx-f366-4xpqCraft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-elementAug 6, 2026
• GHSA-rvmm-v933-jgxqCraft CMS: Missing authorization check allows non-admin control panel users access to user registration metricsAug 6, 2026
• GHSA-7hxc-f267-h5q7Craft CMS: Incorrect path validation could potentially lead to path traversalAug 6, 2026
• GHSA-2rp4-x2j7-qmccCraft CMS: Stored XSS in the control panel via unescaped draft nameAug 6, 2026
• GHSA-p8x7-9vfw-p7vcCraft CMS: Arbitrary user password reset leading to administrator account takeoverAug 6, 2026
• GHSA-f5wm-88jv-g5hxCraft CMS: Authenticated RCE through Twig sandbox escapeAug 6, 2026
• GHSA-265m-7826-wjqmCraft CMS: Authenticated RCE via `condition.config` JSON cleanse bypassAug 6, 2026
• GHSA-86vw-x4ww-x467Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreviewJul 9, 2026
• GHSA-c43v-4cr8-6mvpCraft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file readJul 9, 2026
• GHSA-x76w-8c62-48mgCraft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permissionJul 6, 2026
• GHSA-95wr-3f2v-v2whCraft CMS has a host header injection leading to SSRF via resource-js endpointApr 14, 2026
• GHSA-3m9m-24vh-39wxServer-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads MutationsApr 14, 2026