Security Advisories - craftcms/cms

craftcms/cms Security Advisories for 4.8.0 (20)

[HIGH] Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

PKSA-g2n6-j3mn-x8xf CVE-2026-25498 GHSA-7jx7-3846-m7w7

Affected version: >=4.0.0-RC1,<=4.16.17|>=5.0.0-RC1,<=5.8.21

Reported by:
GitHub
[HIGH] Craft CMS: GraphQL Asset Mutation Privilege Escalation

PKSA-zjy6-pdtw-mck8 CVE-2026-25497 GHSA-fxp3-g6gw-4r4v

Affected version: >=4.0.0-RC1,<4.17.0-beta.1|>=5.0.0-RC1,<5.9.0-beta.1

Reported by:
GitHub
[MEDIUM] Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

PKSA-5pj5-nxp6-547h CVE-2026-25496 GHSA-9f5h-mmq6-2x78

Affected version: >=4.0.0-RC1,<=4.16.17|>=5.0.0-RC1,<=5.8.21

Reported by:
GitHub
[HIGH] Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

PKSA-9dtd-sv51-7pmx CVE-2026-25495 GHSA-2453-mppf-46cj

Affected version: >=4.0.0-RC1,<=4.16.17|>=5.0.0-RC1,<=5.8.21

Reported by:
GitHub
[MEDIUM] Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

PKSA-jsy4-k6z3-fcjb CVE-2026-25494 GHSA-m5r2-8p9x-hp5m

Affected version: >=4.0.0-RC1,<=4.16.17|>=5.0.0-RC1,<=5.8.21

Reported by:
GitHub
[MEDIUM] Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

PKSA-1dbt-xzgs-7gw8 CVE-2026-25493 GHSA-8jr8-7hr4-vhfx

Affected version: >=4.0.0-RC1,<=4.16.17|>=5.0.0-RC1,<=5.8.21

Reported by:
GitHub
[HIGH] Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

PKSA-hcvs-d728-5zyw CVE-2025-68455 GHSA-255j-qw47-wjh5

Affected version: >=4.0.0-RC1,<=4.16.16|>=5.0.0-RC1,<=5.8.20

Reported by:
GitHub
[HIGH] Unauthenticated Craft CMS users can trigger a database backup

PKSA-17hr-tk5g-ht8k CVE-2025-68456 GHSA-v64r-7wg9-23pr

Affected version: >=3.0.0,<=4.16.16|>=5.0.0-RC1,<=5.8.20

Reported by:
GitHub
[MEDIUM] Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

PKSA-9rbz-gy92-qjtd CVE-2025-68454 GHSA-742x-x762-7383

Affected version: >=4.0.0-RC1,<=4.16.16|>=5.0.0-RC1,<=5.8.20

Reported by:
GitHub
[MEDIUM] Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

PKSA-4gr3-459g-ssmq CVE-2025-68437 GHSA-x27p-wfqw-hfcc

Affected version: >=3.5.0,<=4.16.16|>=5.0.0-RC1,<=5.8.20

Reported by:
GitHub
[MEDIUM] Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

PKSA-yj3g-znh5-93sd CVE-2025-68436 GHSA-53vf-c43h-j2x9

Affected version: >=4.0.0-RC1,<=4.16.16|>=5.0.0-RC1,<=5.8.20

Reported by:
GitHub
[MEDIUM] Craft CMS Potential Remote Code Execution via Twig SSTI

PKSA-cbq7-fhfn-fyt5 CVE-2025-57811 GHSA-crcq-738g-pqvc

Affected version: >=5.0.0-RC1,<=5.8.6|>=4.0.0-RC1,<=4.16.5

Reported by:
GitHub
[MEDIUM] Craft CMS stores arbitrary content provided by unauthenticated users in session files

PKSA-ht16-h36v-hxc7 CVE-2025-35939 GHSA-7vrx-9684-xrf2

Affected version: <4.15.3|>=5.0.0-alpha.1,<5.7.5

Reported by:
GitHub
[HIGH] Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

PKSA-8gxy-mg5h-z15w CVE-2025-46731 GHSA-7c58-g782-9j38

Affected version: >=5.0.0-RC1,<=5.6.14|>=4.0.0-RC1,<=4.14.12

Reported by:
GitHub
[CRITICAL] Craft CMS Allows Remote Code Execution

PKSA-5c44-5nbz-c7cq CVE-2025-32432 GHSA-f3gw-9ww9-jmc3

Affected version: >=5.0.0-RC1,<=5.6.16|>=4.0.0-RC1,<=4.14.14|>=3.0.0-RC1,<=3.9.14

Reported by:
GitHub
[HIGH] Craft CMS has a potential RCE with a compromised security key

PKSA-nfqr-ns8g-wkkx CVE-2025-23209 GHSA-x684-96hh-833x

Affected version: >=4.0.0-RC1,<4.13.8|>=5.0.0-RC1,<5.5.5

Reported by:
GitHub
[CRITICAL] Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

PKSA-xh7q-jwpn-v1cd CVE-2024-56145 GHSA-2p6p-9rc9-62j9

Affected version: >=3.0.0,<3.9.14|>=4.0.0-RC1,<4.13.2|>=5.0.0-RC1,<5.5.2

Reported by:
GitHub
[HIGH] Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

PKSA-4wwj-2m42-9pp5 CVE-2024-52293 GHSA-f3cw-hg6r-chfv

Affected version: >=5.0.0-RC1,<=5.4.2|>=4.0.0-RC1,<=4.12.1

Reported by:
GitHub
[HIGH] Craft CMS Arbitrary System File Read

PKSA-jkbm-w624-yb7q CVE-2024-52292 GHSA-cw6g-qmjq-6w2w

Affected version: >=3.5.13,<=4.12.6.1|>=5.0.0-alpha.1,<=5.4.7.1

Reported by:
GitHub
[HIGH] Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

PKSA-mtjx-x487-29s9 CVE-2024-52291 GHSA-jrh5-vhr9-qh7q

Affected version: >=4.0.0-RC1,<=4.12.4.1|>=5.0.0-RC1,<=5.4.5.1

Reported by:
GitHub

craftcms/cms Security Advisories for 4.8.0 (20)

[HIGH] Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

[HIGH] Craft CMS: GraphQL Asset Mutation Privilege Escalation

[MEDIUM] Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

[HIGH] Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

[MEDIUM] Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation

[MEDIUM] Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect

[HIGH] Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

[HIGH] Unauthenticated Craft CMS users can trigger a database backup

[MEDIUM] Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

[MEDIUM] Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation

[MEDIUM] Craft CMS vulnerable to potential information disclosure via unchecked asset relocation

[MEDIUM] Craft CMS Potential Remote Code Execution via Twig SSTI

[MEDIUM] Craft CMS stores arbitrary content provided by unauthenticated users in session files

[HIGH] Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

[CRITICAL] Craft CMS Allows Remote Code Execution

[HIGH] Craft CMS has a potential RCE with a compromised security key

[CRITICAL] Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

[HIGH] Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

[HIGH] Craft CMS Arbitrary System File Read

[HIGH] Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution