{"schema_version":1,"title":"Craft CMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in Craft CMS: 0 in the last 7 days and 9 in the last 90 days, 4 of them critical and 4 exploited in the wild. The most recent, Craft CMS path traversal in ensurePathIsContained, was published on 11 August 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/craft-cms","json_url":"https://junglewise.ai/threats/vendors/craft-cms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/craft-cms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":3,"all_time":18,"critical":4,"exploited":4,"last_7_days":0,"last_30_days":0,"last_90_days":9,"last_365_days":14},"latest":[{"cvss":6.2,"slug":"craft-cms-path-traversal-in-ensurepathiscontained-4adc3058","title":"Craft CMS path traversal in ensurePathIsContained","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1","title":"Craft CMS authenticated RCE through Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1"},{"cvss":6.5,"slug":"craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483","title":"Craft CMS authenticated environment variable leak in Twig templating","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:38+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c"},{"cvss":2.1,"slug":"craft-cms-path-traversal-in-local-file-system-class-15e6d094","title":"Craft CMS path traversal in Local file system class","severity":"low","exploited":false,"published_at":"2026-08-06T21:36:11+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-local-file-system-class-15e6d094"},{"cvss":4.3,"slug":"craft-cms-authorization-bypass-in-charts-endpoint-2400cb5f","title":"Craft CMS authorization bypass in Charts Endpoint","severity":"medium","exploited":false,"published_at":"2026-07-06T06:31:19+00:00","url":"https://junglewise.ai/threats/craft-cms-authorization-bypass-in-charts-endpoint-2400cb5f"},{"cvss":4.3,"slug":"craft-cms-improper-authorization-in-globalscontroller-reorder-sets-f10f3a00","title":"Craft CMS improper authorization in GlobalsController reorder-sets endpoint","severity":"medium","exploited":false,"published_at":"2026-07-06T06:31:19+00:00","url":"https://junglewise.ai/threats/craft-cms-improper-authorization-in-globalscontroller-reorder-sets-f10f3a00"},{"cve":"CVE-2026-14793","cvss":4.3,"epss":0.0039,"slug":"cve-2026-14793-craft-cms-authorization-bypass-in-globalscontroller-reorder-sets","title":"Craft CMS authorization bypass in GlobalsController reorder-sets","severity":"medium","exploited":false,"published_at":"2026-07-06T05:16:34.603+00:00","url":"https://junglewise.ai/threats/cve-2026-14793-craft-cms-authorization-bypass-in-globalscontroller-reorder-sets"},{"cve":"CVE-2026-55792","cvss":4,"epss":0.004,"slug":"cve-2026-55792-craft-cms-sensitive-file-disclosure-via-dataurl-twig-function","title":"Craft CMS sensitive file disclosure via dataUrl Twig function","severity":"medium","exploited":false,"published_at":"2026-07-02T00:16:44.94+00:00","url":"https://junglewise.ai/threats/cve-2026-55792-craft-cms-sensitive-file-disclosure-via-dataurl-twig-function"},{"cvss":6.5,"slug":"craft-cms-path-traversal-in-assets-icon-endpoint-535d8e35","title":"Craft CMS path traversal in assets/icon endpoint","severity":"medium","exploited":false,"published_at":"2026-06-21T15:31:25+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-assets-icon-endpoint-535d8e35"},{"cvss":4.3,"slug":"craft-cms-missing-authorization-in-assets-preview-endpoint-7edb4923","title":"Craft CMS missing authorization in assets preview endpoint","severity":"medium","exploited":false,"published_at":"2026-06-21T15:31:24+00:00","url":"https://junglewise.ai/threats/craft-cms-missing-authorization-in-assets-preview-endpoint-7edb4923"},{"cvss":4.3,"slug":"craft-cms-authorization-bypass-in-assets-preview-endpoint-29d83a67","title":"Craft CMS authorization bypass in assets preview endpoint","severity":"medium","exploited":false,"published_at":"2026-06-21T15:31:24+00:00","url":"https://junglewise.ai/threats/craft-cms-authorization-bypass-in-assets-preview-endpoint-29d83a67"},{"cve":"CVE-2026-31266","cvss":6.5,"slug":"cve-2026-31266-pixel-tonic-craft-cms-missing-authorization-in-migrate-endpoint","title":"Pixel & Tonic Craft CMS missing authorization in migrate endpoint","severity":"info","exploited":false,"published_at":"2026-05-27T15:16:26.467+00:00","url":"https://junglewise.ai/threats/cve-2026-31266-pixel-tonic-craft-cms-missing-authorization-in-migrate-endpoint"},{"cve":"CVE-2026-44011","cvss":4,"epss":0.0044,"slug":"cve-2026-44011-craft-cms-authenticated-rce-via-malicious-behavior-injection-in","title":"Craft CMS authenticated remote code execution in FieldLayout","severity":"high","exploited":false,"published_at":"2026-05-12T21:16:15.87+00:00","url":"https://junglewise.ai/threats/cve-2026-44011-craft-cms-authenticated-rce-via-malicious-behavior-injection-in"},{"cve":"CVE-2025-35939","cvss":3.1,"epss":0.0132,"slug":"cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files","title":"Craft CMS stores arbitrary content provided by unauthenticated users in session files","severity":"critical","exploited":true,"published_at":"2025-05-08T00:31:12+00:00","url":"https://junglewise.ai/threats/cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files"},{"cve":"CVE-2025-32432","cvss":3.1,"epss":0.9979,"slug":"cve-2025-32432-craft-cms-remote-code-execution-via-code-injection","title":"Craft CMS Allows Remote Code Execution","severity":"critical","exploited":true,"published_at":"2025-04-25T15:02:53+00:00","url":"https://junglewise.ai/threats/cve-2025-32432-craft-cms-remote-code-execution-via-code-injection"},{"cve":"CVE-2025-23209","cvss":3.1,"epss":0.2178,"slug":"cve-2025-23209-craft-cms-code-injection-vulnerability","title":"Craft CMS has a potential RCE with a compromised security key","severity":"critical","exploited":true,"published_at":"2025-01-21T19:48:38+00:00","url":"https://junglewise.ai/threats/cve-2025-23209-craft-cms-code-injection-vulnerability"},{"cve":"CVE-2024-56145","cvss":3.1,"epss":0.9741,"slug":"cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration","title":"Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled","severity":"critical","exploited":true,"published_at":"2024-12-18T19:47:26+00:00","url":"https://junglewise.ai/threats/cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration"}],"vendor":{"hub":true,"name":"Craft CMS","slug":"craft-cms","homepage":"https://craftcms.com/","description":"Craft CMS is a content management system developer focused on flexible, custom digital experiences.","url":"https://junglewise.ai/threats/vendors/craft-cms"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2025-32432","cvss":3.1,"epss":0.9979,"slug":"cve-2025-32432-craft-cms-remote-code-execution-via-code-injection","title":"Craft CMS Allows Remote Code Execution","severity":"critical","exploited":true,"published_at":"2025-04-25T15:02:53+00:00","url":"https://junglewise.ai/threats/cve-2025-32432-craft-cms-remote-code-execution-via-code-injection"},{"cve":"CVE-2024-56145","cvss":3.1,"epss":0.9741,"slug":"cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration","title":"Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled","severity":"critical","exploited":true,"published_at":"2024-12-18T19:47:26+00:00","url":"https://junglewise.ai/threats/cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration"},{"cve":"CVE-2025-23209","cvss":3.1,"epss":0.2178,"slug":"cve-2025-23209-craft-cms-code-injection-vulnerability","title":"Craft CMS has a potential RCE with a compromised security key","severity":"critical","exploited":true,"published_at":"2025-01-21T19:48:38+00:00","url":"https://junglewise.ai/threats/cve-2025-23209-craft-cms-code-injection-vulnerability"},{"cve":"CVE-2025-35939","cvss":3.1,"epss":0.0132,"slug":"cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files","title":"Craft CMS stores arbitrary content provided by unauthenticated users in session files","severity":"critical","exploited":true,"published_at":"2025-05-08T00:31:12+00:00","url":"https://junglewise.ai/threats/cve-2025-35939-craft-cms-arbitrary-code-injection-in-session-files"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1","title":"Craft CMS authenticated RCE through Twig sandbox escape","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1"},{"cvss":8.8,"slug":"craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c","title":"Craft CMS authenticated RCE via condition.config JSON cleanse bypass","severity":"high","exploited":false,"published_at":"2026-08-11T15:32:38+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-rce-via-condition-config-json-cleanse-bypass-09aae32c"},{"cve":"CVE-2026-44011","cvss":4,"epss":0.0044,"slug":"cve-2026-44011-craft-cms-authenticated-rce-via-malicious-behavior-injection-in","title":"Craft CMS authenticated remote code execution in FieldLayout","severity":"high","exploited":false,"published_at":"2026-05-12T21:16:15.87+00:00","url":"https://junglewise.ai/threats/cve-2026-44011-craft-cms-authenticated-rce-via-malicious-behavior-injection-in"},{"cvss":6.5,"slug":"craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483","title":"Craft CMS authenticated environment variable leak in Twig templating","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-authenticated-environment-variable-leak-in-twig-templating-b4794483"},{"cvss":6.5,"slug":"craft-cms-path-traversal-in-assets-icon-endpoint-535d8e35","title":"Craft CMS path traversal in assets/icon endpoint","severity":"medium","exploited":false,"published_at":"2026-06-21T15:31:25+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-assets-icon-endpoint-535d8e35"},{"cvss":6.2,"slug":"craft-cms-path-traversal-in-ensurepathiscontained-4adc3058","title":"Craft CMS path traversal in ensurePathIsContained","severity":"medium","exploited":false,"published_at":"2026-08-11T15:32:39+00:00","url":"https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058"}],"generated_at":"2026-09-26T20:07:00.238639+00:00","technologies":[{"name":"Craft CMS","slug":"craft-cms","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/craft-cms"}]}