{"schema_version":1,"title":"Craft CMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 28 vulnerabilities in Craft CMS: 9 in the last 7 days and 22 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115934, was published on 9 November 2026. 20 vulnerabilities in the last four weeks, up 1900% on the four before (1). 2 critical against 0.","url":"https://junglewise.ai/threats/technologies/craft-cms-1","json_url":"https://junglewise.ai/threats/technologies/craft-cms-1.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/craft-cms-1","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":15,"all_time":28,"critical":3,"exploited":0,"last_7_days":9,"last_30_days":17,"last_90_days":22,"last_365_days":28},"latest":[{"cve":"CVE-2026-115934","cvss":9.8,"epss":0.0048,"slug":"cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of","title":"Craft CMS SQL injection in craft.search","severity":"critical","exploited":false,"published_at":"2026-11-09T23:17:12.47+00:00","url":"https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of"},{"cve":"CVE-2026-124431","cvss":4.3,"slug":"cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization","title":"Craft CMS authorization bypass in volume browser","severity":"medium","exploited":false,"published_at":"2026-11-08T14:18:09.147+00:00","url":"https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization"},{"cve":"CVE-2026-124429","cvss":7.5,"slug":"cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege","title":"Craft CMS privilege escalation in public registration","severity":"high","exploited":false,"published_at":"2026-11-08T14:18:08.833+00:00","url":"https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege"},{"cve":"CVE-2026-124428","cvss":6.5,"slug":"cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file","title":"Craft CMS path traversal in app/icon-svg endpoint","severity":"medium","exploited":false,"published_at":"2026-11-08T14:18:08.677+00:00","url":"https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file"},{"cve":"CVE-2026-124427","cvss":9.8,"slug":"cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization","title":"Craft CMS authorization bypass in GraphQL schema scope","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:08.517+00:00","url":"https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization"},{"cve":"CVE-2026-124426","cvss":5.3,"slug":"cve-2026-124426-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization","title":"Craft CMS authorization bypass in GraphQL localized field","severity":"medium","exploited":false,"published_at":"2026-11-08T14:18:08.35+00:00","url":"https://junglewise.ai/threats/cve-2026-124426-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization"},{"cve":"CVE-2026-123491","cvss":8.2,"slug":"cve-2026-123491-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains","title":"Craft CMS SQL injection in GraphQL eager-loading","severity":"high","exploited":false,"published_at":"2026-11-06T15:17:18.663+00:00","url":"https://junglewise.ai/threats/cve-2026-123491-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains"},{"cve":"CVE-2026-123490","cvss":8.8,"slug":"cve-2026-123490-craft-cms-from-5-8-17-before-5-11-2-contains-a-privilege","title":"Craft CMS privilege escalation via getOwners() sandbox bypass","severity":"high","exploited":false,"published_at":"2026-11-06T15:17:18.483+00:00","url":"https://junglewise.ai/threats/cve-2026-123490-craft-cms-from-5-8-17-before-5-11-2-contains-a-privilege"},{"cve":"CVE-2026-123488","cvss":9.8,"slug":"cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains","title":"Craft CMS SQL injection in element search endpoint","severity":"critical","exploited":false,"published_at":"2026-11-06T15:17:18.133+00:00","url":"https://junglewise.ai/threats/cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains"},{"cve":"CVE-2026-115938","cvss":8.8,"slug":"cve-2026-115938-craft-cms-allows-any-authenticated-control-panel-user-to-submit","title":"Craft CMS template injection in element search","severity":"high","exploited":false,"published_at":"2026-10-23T22:16:59.597+00:00","url":"https://junglewise.ai/threats/cve-2026-115938-craft-cms-allows-any-authenticated-control-panel-user-to-submit"},{"cve":"CVE-2026-115935","cvss":8.8,"slug":"cve-2026-115935-the-app-process-api-response-headers-action-accepts-fake-craft","title":"Craft CMS privilege escalation via API response header injection","severity":"high","exploited":false,"published_at":"2026-10-23T22:16:59.29+00:00","url":"https://junglewise.ai/threats/cve-2026-115935-the-app-process-api-response-headers-action-accepts-fake-craft"},{"cve":"CVE-2026-112777","cvss":7.2,"slug":"cve-2026-112777-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a","title":"Craft CMS blocklist bypass in Twig create() function","severity":"high","exploited":false,"published_at":"2026-10-19T20:17:55.043+00:00","url":"https://junglewise.ai/threats/cve-2026-112777-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a"},{"cve":"CVE-2026-112775","cvss":7.5,"slug":"cve-2026-112775-craft-cms-from-5-0-0-before-5-11-0-contains-an-authentication","title":"Craft CMS verification code reuse allows account takeover","severity":"high","exploited":false,"published_at":"2026-10-19T20:17:54.757+00:00","url":"https://junglewise.ai/threats/cve-2026-112775-craft-cms-from-5-0-0-before-5-11-0-contains-an-authentication"},{"cve":"CVE-2026-112774","cvss":7.2,"slug":"cve-2026-112774-craft-cms-from-5-8-0-before-5-11-0-contains-a-remote-code","title":"Craft CMS authenticated admin RCE via ContentBlock field-layout","severity":"high","exploited":false,"published_at":"2026-10-19T20:17:54.62+00:00","url":"https://junglewise.ai/threats/cve-2026-112774-craft-cms-from-5-8-0-before-5-11-0-contains-a-remote-code"},{"cve":"CVE-2026-112773","cvss":8.8,"slug":"cve-2026-112773-craft-cms-from-5-0-0-before-5-11-0-contains-a-remote-code","title":"Craft CMS Twig sandbox escape and remote code execution","severity":"high","exploited":false,"published_at":"2026-10-19T20:17:54.48+00:00","url":"https://junglewise.ai/threats/cve-2026-112773-craft-cms-from-5-0-0-before-5-11-0-contains-a-remote-code"},{"cve":"CVE-2026-112771","cvss":6.5,"slug":"cve-2026-112771-craft-cms-4-0-0-before-4-18-8-and-5-0-0-before-5-11-0-contains-a","title":"Craft CMS Twig sandbox allowlist bypass via array filters","severity":"medium","exploited":false,"published_at":"2026-10-19T20:17:54.203+00:00","url":"https://junglewise.ai/threats/cve-2026-112771-craft-cms-4-0-0-before-4-18-8-and-5-0-0-before-5-11-0-contains-a"},{"cve":"CVE-2026-112770","cvss":8.8,"slug":"cve-2026-112770-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a","title":"Craft CMS Twig group filter remote code execution","severity":"high","exploited":false,"published_at":"2026-10-19T20:17:54.06+00:00","url":"https://junglewise.ai/threats/cve-2026-112770-craft-cms-4-x-before-4-18-8-and-5-x-before-5-11-0-contains-a"},{"cve":"CVE-2026-109308","cvss":8.8,"epss":0.0049,"slug":"cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes","title":"Craft CMS behavior injection RCE in AppController::actionCacheUpdates","severity":"high","exploited":false,"published_at":"2026-10-12T17:17:25.227+00:00","url":"https://junglewise.ai/threats/cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes"},{"cve":"CVE-2026-109307","cvss":4.7,"epss":0.0019,"slug":"cve-2026-109307-craft-cms-5-0-0-before-5-10-14-contains-a-dom-based-cross-site","title":"Craft CMS DOM-based cross-site scripting in 2FA verification","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:25.077+00:00","url":"https://junglewise.ai/threats/cve-2026-109307-craft-cms-5-0-0-before-5-10-14-contains-a-dom-based-cross-site"},{"cve":"CVE-2026-109305","cvss":8.8,"epss":0.0049,"slug":"cve-2026-109305-craft-cms-from-5-10-2-before-5-10-14-contains-a-twig-sandbox","title":"Craft CMS Twig sandbox bypass in \"has some\"/\"has every\" operators","severity":"high","exploited":false,"published_at":"2026-10-12T17:17:24.773+00:00","url":"https://junglewise.ai/threats/cve-2026-109305-craft-cms-from-5-10-2-before-5-10-14-contains-a-twig-sandbox"},{"cve":"CVE-2026-109304","cvss":4.9,"epss":0.0031,"slug":"cve-2026-109304-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-contains","title":"Craft CMS arbitrary file read via Twig create() DOMDocument","severity":"medium","exploited":false,"published_at":"2026-10-12T17:17:24.61+00:00","url":"https://junglewise.ai/threats/cve-2026-109304-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-contains"},{"cve":"CVE-2026-105985","cvss":8.8,"slug":"cve-2026-105985-craft-cms-5-10-13-2-contains-an-authenticated-remote-code","title":"Craft CMS authenticated remote code execution in Control Panel","severity":"high","exploited":false,"published_at":"2026-10-06T11:17:16.857+00:00","url":"https://junglewise.ai/threats/cve-2026-105985-craft-cms-5-10-13-2-contains-an-authenticated-remote-code"},{"cve":"CVE-2026-72783","cvss":6.2,"epss":0.002,"slug":"cve-2026-72783-craft-cms-path-traversal-in-ensurepathiscontained","title":"Craft CMS path traversal in ensurePathIsContained","severity":"medium","exploited":false,"published_at":"2026-08-11T13:19:08.94+00:00","url":"https://junglewise.ai/threats/cve-2026-72783-craft-cms-path-traversal-in-ensurepathiscontained"},{"cve":"CVE-2026-72782","cvss":6.5,"epss":0.0039,"slug":"cve-2026-72782-craft-cms-environment-variable-leak-in-twig-sandbox","title":"Craft CMS environment variable leak in Twig sandbox","severity":"medium","exploited":false,"published_at":"2026-08-11T13:19:08.797+00:00","url":"https://junglewise.ai/threats/cve-2026-72782-craft-cms-environment-variable-leak-in-twig-sandbox"},{"cve":"CVE-2026-72781","cvss":8.8,"epss":0.0079,"slug":"cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape","title":"Craft CMS remote code execution via Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T13:19:08.657+00:00","url":"https://junglewise.ai/threats/cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":8},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":2,"exploited":0,"vulnerabilities":8},{"week":"2026-11-09","critical":1,"exploited":0,"vulnerabilities":1}],"related":[],"technology":{"hub":true,"name":"Craft CMS","slug":"craft-cms-1","vendor":{"hub":true,"name":"Craft","slug":"craft","url":"https://junglewise.ai/threats/vendors/craft"},"aliases":[],"category":"cms","description":"Craft CMS is a content management system for managing and publishing digital content.","url":"https://junglewise.ai/threats/technologies/craft-cms-1"},"most_severe":[{"cve":"CVE-2026-115934","cvss":9.8,"epss":0.0048,"slug":"cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of","title":"Craft CMS SQL injection in craft.search","severity":"critical","exploited":false,"published_at":"2026-11-09T23:17:12.47+00:00","url":"https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of"},{"cve":"CVE-2026-124427","cvss":9.8,"slug":"cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization","title":"Craft CMS authorization bypass in GraphQL schema scope","severity":"critical","exploited":false,"published_at":"2026-11-08T14:18:08.517+00:00","url":"https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization"},{"cve":"CVE-2026-123488","cvss":9.8,"slug":"cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains","title":"Craft CMS SQL injection in element search endpoint","severity":"critical","exploited":false,"published_at":"2026-11-06T15:17:18.133+00:00","url":"https://junglewise.ai/threats/cve-2026-123488-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains"},{"cve":"CVE-2026-72778","cvss":8.8,"epss":0.008,"slug":"cve-2026-72778-craft-cms-authenticated-remote-code-execution-in-element-search","title":"Craft CMS authenticated remote code execution in element-search condition","severity":"high","exploited":false,"published_at":"2026-08-11T13:19:08.207+00:00","url":"https://junglewise.ai/threats/cve-2026-72778-craft-cms-authenticated-remote-code-execution-in-element-search"},{"cve":"CVE-2026-72781","cvss":8.8,"epss":0.0079,"slug":"cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape","title":"Craft CMS remote code execution via Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T13:19:08.657+00:00","url":"https://junglewise.ai/threats/cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape"},{"cve":"CVE-2026-109308","cvss":8.8,"epss":0.0049,"slug":"cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes","title":"Craft CMS behavior injection RCE in AppController::actionCacheUpdates","severity":"high","exploited":false,"published_at":"2026-10-12T17:17:25.227+00:00","url":"https://junglewise.ai/threats/cve-2026-109308-craft-cms-4-0-0-before-4-18-7-and-5-0-0-before-5-10-14-passes"},{"cve":"CVE-2026-109305","cvss":8.8,"epss":0.0049,"slug":"cve-2026-109305-craft-cms-from-5-10-2-before-5-10-14-contains-a-twig-sandbox","title":"Craft CMS Twig sandbox bypass in \"has some\"/\"has every\" operators","severity":"high","exploited":false,"published_at":"2026-10-12T17:17:24.773+00:00","url":"https://junglewise.ai/threats/cve-2026-109305-craft-cms-from-5-10-2-before-5-10-14-contains-a-twig-sandbox"},{"cve":"CVE-2026-123490","cvss":8.8,"slug":"cve-2026-123490-craft-cms-from-5-8-17-before-5-11-2-contains-a-privilege","title":"Craft CMS privilege escalation via getOwners() sandbox bypass","severity":"high","exploited":false,"published_at":"2026-11-06T15:17:18.483+00:00","url":"https://junglewise.ai/threats/cve-2026-123490-craft-cms-from-5-8-17-before-5-11-2-contains-a-privilege"},{"cve":"CVE-2026-115938","cvss":8.8,"slug":"cve-2026-115938-craft-cms-allows-any-authenticated-control-panel-user-to-submit","title":"Craft CMS template injection in element search","severity":"high","exploited":false,"published_at":"2026-10-23T22:16:59.597+00:00","url":"https://junglewise.ai/threats/cve-2026-115938-craft-cms-allows-any-authenticated-control-panel-user-to-submit"},{"cve":"CVE-2026-115935","cvss":8.8,"slug":"cve-2026-115935-the-app-process-api-response-headers-action-accepts-fake-craft","title":"Craft CMS privilege escalation via API response header injection","severity":"high","exploited":false,"published_at":"2026-10-23T22:16:59.29+00:00","url":"https://junglewise.ai/threats/cve-2026-115935-the-app-process-api-response-headers-action-accepts-fake-craft"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}