CVE-2026-40174

Masa CMS versions 7.5.2 and earlier have a vulnerability in the createBundle method in `csettings.cfc` that improperly validates anti-CSRF tokens. An attacker can craft a malicious webpage that, when visited by a logged-in administrator, silently creates a site bundle that is saved in a publicly accessible directory.

Masa CMS, a fork of Mura CMS, in versions 7.5.2 and earlier has a vulnerability in the `cTrash.restore` function that improperly validates anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator into submitting a forged request that restores deleted items.

Masa CMS versions 7.5.2 and earlier have a vulnerability in the cTrash.empty function that does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content.

Masa CMS versions 7.2.0-7.2.9, 7.3.0-7.3.14, 7.4.0-7.4.9, and 7.5.0-7.5.2 have an SQL injection vulnerability in the unauthenticated JSON API. The altTable parameter is injected directly into the SQL FROM clause, allowing an unauthenticated attacker to read sensitive data from any table.

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.

Masa CMS before versions 7.2.8, 7.3.13, and 7.4.6 is vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter, subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag.