{"schema_version":1,"title":"Craft CMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 46 vulnerabilities in Craft CMS: 0 in the last 7 days and 27 in the last 90 days, 6 of them critical and 5 exploited in the wild. The most recent, Craft CMS authenticated RCE through Twig sandbox escape, was published on 11 August 2026.","url":"https://junglewise.ai/threats/technologies/craft-cms","json_url":"https://junglewise.ai/threats/technologies/craft-cms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/craft-cms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":13,"all_time":46,"critical":6,"exploited":5,"last_7_days":0,"last_30_days":0,"last_90_days":27,"last_365_days":42},"latest":[{"cvss":8.8,"slug":"craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1","title":"Craft CMS authenticated RCE through Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1"},{"cvss":6.5,"slug":"craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483","title":"Craft CMS authenticated environment variable leak in Twig templating","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483"},{"cvss":6.2,"slug":"craft-cms-path-traversal-in-ensurepathiscontained-4adc3058","title":"Craft CMS path traversal in ensurePathIsContained","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:38+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c"},{"cvss":9.1,"slug":"craft-cms-authentication-bypass-via-webauthn-replay-in-passkey-login-5577ef1c","title":"Craft CMS authentication bypass via WebAuthn replay in passkey login","severity":"critical","exploited":false,"published_at":"2026-08-07T14:57:29+00:00","url":"https://junglewise.ai/threats/craft-cms-authentication-bypass-via-webauthn-replay-in-passkey-login-5577ef1c"},{"cvss":6.9,"slug":"craft-cms-arbitrary-file-read-via-splfileobject-in-twig-templates-1e0ddcaf","title":"Craft CMS arbitrary file read via SplFileObject in Twig templates","severity":"medium","exploited":false,"published_at":"2026-08-06T21:54:45+00:00","url":"https://junglewise.ai/threats/craft-cms-arbitrary-file-read-via-splfileobject-in-twig-templates-1e0ddcaf"},{"cvss":5.1,"slug":"craft-cms-environment-variable-leak-via-twig-sandbox-bypass-54f53d6c","title":"Craft CMS environment variable leak via Twig sandbox bypass","severity":"medium","exploited":false,"published_at":"2026-08-06T21:53:31+00:00","url":"https://junglewise.ai/threats/craft-cms-environment-variable-leak-via-twig-sandbox-bypass-54f53d6c"},{"cvss":5.3,"slug":"craft-cms-authorization-bypass-in-category-structure-management-d28fa120","title":"Craft CMS authorization bypass in category structure management","severity":"medium","exploited":false,"published_at":"2026-08-06T21:43:54+00:00","url":"https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-management-d28fa120"},{"cvss":2.1,"slug":"craft-cms-path-traversal-in-local-file-system-class-15e6d094","title":"Craft CMS path traversal in Local file system class","severity":"low","exploited":false,"published_at":"2026-08-06T21:36:11+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-local-file-system-class-15e6d094"},{"cvss":5.1,"slug":"craft-cms-stored-xss-via-unescaped-draft-name-in-control-panel-11756086","title":"Craft CMS stored XSS via unescaped draft name in control panel","severity":"medium","exploited":false,"published_at":"2026-08-06T21:33:15+00:00","url":"https://junglewise.ai/threats/craft-cms-stored-xss-via-unescaped-draft-name-in-control-panel-11756086"},{"cvss":8.7,"slug":"craft-cms-twig-sandbox-escape-leading-to-authenticated-rce-f8c70cd6","title":"Craft CMS Twig sandbox escape leading to authenticated RCE","severity":"high","exploited":false,"published_at":"2026-08-06T21:02:28+00:00","url":"https://junglewise.ai/threats/craft-cms-twig-sandbox-escape-leading-to-authenticated-rce-f8c70cd6"},{"cvss":8.7,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-08cfc3c0","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-06T20:45:00+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-08cfc3c0"},{"cvss":8.6,"slug":"craft-cms-rce-via-event-handler-injection-in-fieldscontroller-75a0fa05","title":"Craft CMS RCE via event handler injection in FieldsController","severity":"high","exploited":false,"published_at":"2026-07-09T13:44:12+00:00","url":"https://junglewise.ai/threats/craft-cms-rce-via-event-handler-injection-in-fieldscontroller-75a0fa05"},{"cvss":2,"slug":"craft-cms-path-traversal-in-assets-icon-63cafdb8","title":"Craft CMS path traversal in assets/icon","severity":"low","exploited":false,"published_at":"2026-07-09T13:44:06+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-assets-icon-63cafdb8"},{"cvss":5.3,"slug":"craft-cms-missing-authorization-in-assets-preview-thumb-endpoint-cdf88df3","title":"Craft CMS missing authorization in assets/preview-thumb endpoint","severity":"medium","exploited":false,"published_at":"2026-07-06T20:28:07+00:00","url":"https://junglewise.ai/threats/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint-cdf88df3"},{"cvss":4.3,"slug":"craft-cms-improper-authorization-in-globalscontroller-reorder-sets-f10f3a00","title":"Craft CMS improper authorization in GlobalsController reorder-sets endpoint","severity":"medium","exploited":false,"published_at":"2026-07-06T06:31:19+00:00","url":"https://junglewise.ai/threats/craft-cms-improper-authorization-in-globalscontroller-reorder-sets-f10f3a00"},{"cvss":4.3,"slug":"craft-cms-authorization-bypass-in-charts-endpoint-2400cb5f","title":"Craft CMS authorization bypass in Charts Endpoint","severity":"medium","exploited":false,"published_at":"2026-07-06T06:31:19+00:00","url":"https://junglewise.ai/threats/craft-cms-authorization-bypass-in-charts-endpoint-2400cb5f"},{"cve":"CVE-2026-14793","cvss":4.3,"epss":0.0022,"slug":"cve-2026-14793-craft-cms-authorization-bypass-in-globalscontroller-reorder-sets","title":"Craft CMS authorization bypass in GlobalsController reorder-sets","severity":"medium","exploited":false,"published_at":"2026-07-06T05:16:34.603+00:00","url":"https://junglewise.ai/threats/cve-2026-14793-craft-cms-authorization-bypass-in-globalscontroller-reorder-sets"},{"cve":"CVE-2026-50282","cvss":4.9,"slug":"cve-2026-50282-craft-cms-authorization-bypass-in-assetscontroller-folder-move","title":"Craft CMS authorization bypass in AssetsController folder move","severity":"high","exploited":false,"published_at":"2026-07-02T17:17:01.07+00:00","url":"https://junglewise.ai/threats/cve-2026-50282-craft-cms-authorization-bypass-in-assetscontroller-folder-move"},{"cve":"CVE-2026-50281","cvss":7.1,"slug":"cve-2026-50281-craft-cms-mass-assignment-in-bulk-duplicate-element-action","title":"Craft CMS mass assignment in bulk-duplicate element action","severity":"high","exploited":false,"published_at":"2026-07-02T17:17:00+00:00","url":"https://junglewise.ai/threats/cve-2026-50281-craft-cms-mass-assignment-in-bulk-duplicate-element-action"},{"cve":"CVE-2026-55792","cvss":6,"epss":0.0027,"slug":"cve-2026-55792-craft-cms-sensitive-file-disclosure-via-dataurl-twig-function","title":"Craft CMS sensitive file disclosure via dataUrl Twig function","severity":"medium","exploited":false,"published_at":"2026-07-02T00:16:44.94+00:00","url":"https://junglewise.ai/threats/cve-2026-55792-craft-cms-sensitive-file-disclosure-via-dataurl-twig-function"},{"cve":"CVE-2026-50280","cvss":6,"epss":0.0027,"slug":"cve-2026-50280-craft-cms-authorization-bypass-in-entriescontroller-move-to","title":"Craft CMS authorization bypass in EntriesController move-to-section","severity":"medium","exploited":false,"published_at":"2026-07-02T00:16:44.677+00:00","url":"https://junglewise.ai/threats/cve-2026-50280-craft-cms-authorization-bypass-in-entriescontroller-move-to"},{"cve":"CVE-2026-50279","cvss":7.6,"epss":0.0025,"slug":"cve-2026-50279-craft-cms-authorship-spoofing-in-entriescontroller","title":"Craft CMS authorship spoofing in EntriesController","severity":"high","exploited":false,"published_at":"2026-07-02T00:16:44.543+00:00","url":"https://junglewise.ai/threats/cve-2026-50279-craft-cms-authorship-spoofing-in-entriescontroller"},{"cve":"CVE-2026-55790","cvss":7.4,"epss":0.0031,"slug":"cve-2026-55790-craft-cms-dom-xss-in-craftsupport-widget-via-github-issue-titles","title":"Craft CMS DOM XSS in CraftSupport widget via GitHub issue titles","severity":"high","exploited":false,"published_at":"2026-07-01T23:16:52.483+00:00","url":"https://junglewise.ai/threats/cve-2026-55790-craft-cms-dom-xss-in-craftsupport-widget-via-github-issue-titles"},{"cve":"CVE-2026-50284","cvss":7.1,"epss":0.0025,"slug":"cve-2026-50284-craft-cms-authorization-bypass-in-assetscontroller-folder","title":"Craft CMS authorization bypass in AssetsController folder deletion","severity":"high","exploited":false,"published_at":"2026-07-01T23:16:52.35+00:00","url":"https://junglewise.ai/threats/cve-2026-50284-craft-cms-authorization-bypass-in-assetscontroller-folder"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":9},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":1,"exploited":0,"vulnerabilities":8},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Craft CMS","slug":"craft-cms","vendor":{"name":"Craft CMS","slug":"craft-cms","url":"https://junglewise.ai/threats/vendors/craft-cms"},"aliases":[],"category":"cms","homepage":"https://craftcms.com/","repo_url":"https://github.com/craftcms/cms","description":"A flexible, user-friendly content management system for developers, designers, and content managers.","url":"https://junglewise.ai/threats/technologies/craft-cms"},"most_severe":[{"cve":"CVE-2025-32432","cvss":10,"epss":0.9265,"slug":"cve-2025-32432-craft-cms-remote-code-execution-via-code-injection","title":"Craft CMS remote code execution via code injection","severity":"critical","exploited":true,"published_at":"2026-03-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-32432-craft-cms-remote-code-execution-via-code-injection"},{"cve":"CVE-2024-56145","cvss":9.8,"epss":0.9415,"slug":"cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration","title":"Craft CMS code injection in PHP register_argc_argv configuration","severity":"critical","exploited":true,"published_at":"2025-06-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration"},{"cve":"CVE-2024-58136","cvss":9.8,"slug":"cve-2024-58136-yiiframework-yii-improper-protection-of-alternate-path","title":"Yiiframework Yii Improper Protection of Alternate Path Vulnerability","severity":"critical","exploited":true,"published_at":"2025-05-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-58136-yiiframework-yii-improper-protection-of-alternate-path"},{"cve":"CVE-2025-23209","cvss":8.1,"slug":"cve-2025-23209-craft-cms-code-injection-vulnerability","title":"Craft CMS Code Injection Vulnerability","severity":"critical","exploited":true,"published_at":"2025-02-20T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-23209-craft-cms-code-injection-vulnerability"},{"cve":"CVE-2025-35939","cvss":5.3,"epss":0.3307,"slug":"cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files","title":"Craft CMS arbitrary code injection in session files","severity":"critical","exploited":true,"published_at":"2025-06-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files"},{"cvss":9.1,"slug":"craft-cms-authentication-bypass-via-webauthn-replay-in-passkey-login-5577ef1c","title":"Craft CMS authentication bypass via WebAuthn replay in passkey login","severity":"critical","exploited":false,"published_at":"2026-08-07T14:57:29+00:00","url":"https://junglewise.ai/threats/craft-cms-authentication-bypass-via-webauthn-replay-in-passkey-login-5577ef1c"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1","title":"Craft CMS authenticated RCE through Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:38+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c"},{"cvss":8.7,"slug":"craft-cms-twig-sandbox-escape-leading-to-authenticated-rce-f8c70cd6","title":"Craft CMS Twig sandbox escape leading to authenticated RCE","severity":"high","exploited":false,"published_at":"2026-08-06T21:02:28+00:00","url":"https://junglewise.ai/threats/craft-cms-twig-sandbox-escape-leading-to-authenticated-rce-f8c70cd6"},{"cvss":8.7,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-08cfc3c0","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-06T20:45:00+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-08cfc3c0"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}