# craftcms/cms (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/craftcms-cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/craftcms-cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 143 vulnerabilities in craftcms/cms (Packagist): 0 in the last 7 days and 0 in the last 90 days, 6 of them critical and 4 exploited in the wild. The most recent, CVE-2026-72787, was published on 12 August 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 143 (6 critical, 4 exploited in the wild) ## About craftcms/cms (Packagist) Content management system written in PHP with a flexible and customizable architecture. ## Latest craftcms/cms (Packagist) vulnerabilities - [CVE-2026-72787: Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft) (medium, CVSS 6.4, published 12 Aug 2026) - [CVE-2026-72786: Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator) (medium, CVSS 6.5, published 12 Aug 2026) - [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058) (medium, CVSS 6.2, published 11 Aug 2026) - [Craft CMS authenticated environment variable leak in Twig templating](https://junglewise.ai/threats/craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483) (medium, CVSS 6.5, published 11 Aug 2026) - [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980) (medium, CVSS 4.3, published 11 Aug 2026) - [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1) (high, CVSS 8.8, published 11 Aug 2026) - [Craft CMS arbitrary file read via SplFileObject in template contexts](https://junglewise.ai/threats/craft-cms-arbitrary-file-read-via-splfileobject-in-template-contexts-ea56dfbf) (medium, CVSS 4.5, published 11 Aug 2026) - [Craft CMS authenticated RCE via condition.config JSON cleanse bypass](https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-72785: Craft CMS authorization bypass in category structure editing](https://junglewise.ai/threats/cve-2026-72785-craft-cms-authorization-bypass-in-category-structure-editing) (medium, CVSS 4.3, published 11 Aug 2026) - [CVE-2026-72783: Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/cve-2026-72783-craft-cms-path-traversal-in-ensurepathiscontained) (medium, CVSS 6.2, published 11 Aug 2026) - [CVE-2026-72782: Craft CMS environment variable leak in Twig sandbox](https://junglewise.ai/threats/cve-2026-72782-craft-cms-environment-variable-leak-in-twig-sandbox) (medium, CVSS 6.5, published 11 Aug 2026) - [CVE-2026-72781: Craft CMS remote code execution via Twig sandbox escape](https://junglewise.ai/threats/cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-72780: Craft CMS WebAuthn assertion replay in passkey login](https://junglewise.ai/threats/cve-2026-72780-craft-cms-webauthn-assertion-replay-in-passkey-login) (medium, CVSS 6.5, published 11 Aug 2026) - [CVE-2026-72779: Craft CMS arbitrary file read via SplFileObject in Twig create()](https://junglewise.ai/threats/cve-2026-72779-craft-cms-arbitrary-file-read-via-splfileobject-in-twig-create) (medium, CVSS 4.5, published 11 Aug 2026) - [CVE-2026-72778: Craft CMS authenticated remote code execution in element-search condition](https://junglewise.ai/threats/cve-2026-72778-craft-cms-authenticated-remote-code-execution-in-element-search) (high, CVSS 8.8, published 11 Aug 2026) - [Craft CMS improper authorization in GlobalsController reorder-sets endpoint](https://junglewise.ai/threats/craft-cms-improper-authorization-in-globalscontroller-reorder-sets-f10f3a00) (medium, CVSS 4.3, published 6 Jul 2026) - [CVE-2026-14794: Craft CMS improper authorization in Charts Endpoint](https://junglewise.ai/threats/cve-2026-14794-craft-cms-improper-authorization-in-charts-endpoint) (medium, CVSS 4.3, published 6 Jul 2026) - [CVE-2026-14793: Craft CMS authorization bypass in GlobalsController reorder-sets](https://junglewise.ai/threats/cve-2026-14793-craft-cms-authorization-bypass-in-globalscontroller-reorder-sets) (medium, CVSS 4.3, published 6 Jul 2026) - [CVE-2026-50282: Craft CMS authorization bypass in AssetsController folder move](https://junglewise.ai/threats/cve-2026-50282-craft-cms-authorization-bypass-in-assetscontroller-folder-move) (high, CVSS 4, published 2 Jul 2026) - [CVE-2026-50281: Craft CMS mass assignment in bulk-duplicate element action](https://junglewise.ai/threats/cve-2026-50281-craft-cms-mass-assignment-in-bulk-duplicate-element-action) (high, CVSS 4, published 2 Jul 2026) - [CVE-2026-55794: Craft CMS authenticated RCE via Twig injection in Referrer header](https://junglewise.ai/threats/cve-2026-55794-craft-cms-authenticated-rce-via-twig-injection-in-referrer-header) (high, CVSS 4, published 2 Jul 2026) - [CVE-2026-55792: Craft CMS sensitive file disclosure via dataUrl Twig function](https://junglewise.ai/threats/cve-2026-55792-craft-cms-sensitive-file-disclosure-via-dataurl-twig-function) (medium, CVSS 4, published 2 Jul 2026) - [CVE-2026-55791: Craft CMS SSRF and JavaScript injection via Host header poisoning](https://junglewise.ai/threats/cve-2026-55791-craft-cms-ssrf-and-javascript-injection-via-host-header-poisoning) (critical, CVSS 4, published 2 Jul 2026) - [CVE-2026-50280: Craft CMS authorization bypass in EntriesController move-to-section](https://junglewise.ai/threats/cve-2026-50280-craft-cms-authorization-bypass-in-entriescontroller-move-to) (medium, CVSS 4, published 2 Jul 2026) - [CVE-2026-50279: Craft CMS authorship spoofing in EntriesController](https://junglewise.ai/threats/cve-2026-50279-craft-cms-authorship-spoofing-in-entriescontroller) (high, CVSS 4, published 2 Jul 2026) ## Most severe craftcms/cms (Packagist) vulnerabilities - [CVE-2025-32432: Craft CMS Allows Remote Code Execution](https://junglewise.ai/threats/cve-2025-32432-craft-cms-remote-code-execution-via-code-injection) (critical, exploited in the wild, CVSS 3.1, published 25 Apr 2025) - [CVE-2024-56145: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled](https://junglewise.ai/threats/cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration) (critical, exploited in the wild, CVSS 3.1, published 18 Dec 2024) - [CVE-2025-23209: Craft CMS has a potential RCE with a compromised security key](https://junglewise.ai/threats/cve-2025-23209-craft-cms-code-injection-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 21 Jan 2025) - [CVE-2025-35939: Craft CMS stores arbitrary content provided by unauthenticated users in session files](https://junglewise.ai/threats/cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files) (critical, exploited in the wild, CVSS 3.1, published 8 May 2025) - [CVE-2025-68456: Unauthenticated Craft CMS users can trigger a database backup](https://junglewise.ai/threats/cve-2025-68456-unauthenticated-craft-cms-users-can-trigger-a-database-backup) (critical, CVSS 9.1, published 5 Jan 2026) - [CVE-2026-55791: Craft CMS SSRF and JavaScript injection via Host header poisoning](https://junglewise.ai/threats/cve-2026-55791-craft-cms-ssrf-and-javascript-injection-via-host-header-poisoning) (critical, CVSS 4, published 2 Jul 2026) - [CVE-2025-68454: Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI](https://junglewise.ai/threats/cve-2025-68454-craft-cms-vulnerable-to-potential-authenticated-remote-code) (high, CVSS 8.8, published 5 Jan 2026) - [CVE-2026-72778: Craft CMS authenticated remote code execution in element-search condition](https://junglewise.ai/threats/cve-2026-72778-craft-cms-authenticated-remote-code-execution-in-element-search) (high, CVSS 8.8, published 11 Aug 2026) - [CVE-2026-72781: Craft CMS remote code execution via Twig sandbox escape](https://junglewise.ai/threats/cve-2026-72781-craft-cms-remote-code-execution-via-twig-sandbox-escape) (high, CVSS 8.8, published 11 Aug 2026) - [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1) (high, CVSS 8.8, published 11 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities - [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq): 119 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "craftcms/cms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/craftcms-cms, 11 November 2026.