Executive brief
Mura CMS, a platform used for managing and publishing website content, contains a critical security flaw. An attacker can remotely execute unauthorized commands on the server hosting the website. This could lead to a complete system takeover, theft of sensitive customer data, or a total service outage.
Technical details
A remote code execution (RCE) vulnerability exists in Mura CMS versions prior to 10.0.712. The flaw is located in the '/index.cfm/_api/json/v1/default' endpoint, where the 'method' parameter in POST requests is processed by the ColdFusion engine without sufficient validation or sanitization. An attacker can exploit this to inject arbitrary ColdFusion Markup Language (CFML) expressions and instantiate malicious Java objects. While the CVSS 4.0 score is listed as 5.1 (Medium) due to a 'User Interaction' requirement in the vector string, the advisory text describes the impact as critical RCE. No official patch or solution has been reported as of the advisory date.
Affected products
- Mura Software CMS prior to 10.0.712
Timeline
- 2026-07-13: disclosed: Vulnerability discovered by Miguel Segovia Gil and published by INCIBE-CERT.
- 2026-07-13: advisory