CVE-2026-40326
HighSummary
Masa CMS versions 7.5.2 and earlier have a vulnerability in the createBundle method in `csettings.cfc` that improperly validates anti-CSRF tokens. An attacker can craft a malicious webpage that, when visited by a logged-in administrator, silently creates a site bundle that is saved in a publicly accessible directory.
Risk Assessment
An unauthenticated attacker can retrieve the bundle and gain access to site content, user account data, password hashes, form submissions, email lists, plugins, and configuration data. This poses a serious threat to the organization's data security.
Recommendation
It is recommended to upgrade to versions 7.2.10, 7.3.15, 7.4.10, or 7.5.3. As a workaround, remove unexpected bundle files from public directories, restrict access to the affected endpoint, and limit exposure of administrative sessions.
Other vulnerabilities in Masa CMS
See all- CVE-2026-40325High
Masa CMS, a fork of Mura CMS, in versions 7.5.2 and earlier has a vulnerability in the `cTrash.restore` function that improperly validates anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator into submitting a forged request that restores deleted items.
- CVE-2026-40309High
Masa CMS versions 7.5.2 and earlier have a vulnerability in the cTrash.empty function that does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content.
- CVE-2026-40174High
Masa CMS, a content management system, in versions 7.5.2 and earlier has a vulnerability in the cUsers.updateAddress function that improperly validates anti-CSRF tokens. An attacker can induce a logged-in administrator to submit a forged request, allowing for the addition, modification, or deletion of user address records.
- CVE-2026-40331Critical
Masa CMS versions 7.2.0-7.2.9, 7.3.0-7.3.14, 7.4.0-7.4.9, and 7.5.0-7.5.2 have an SQL injection vulnerability in the unauthenticated JSON API. The altTable parameter is injected directly into the SQL FROM clause, allowing an unauthenticated attacker to read sensitive data from any table.
- CVE-2026-40330Critical
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.
- CVE-2026-40329Critical
Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.
- CVE-2024-32641Critical
Masa CMS before versions 7.2.8, 7.3.13, and 7.4.6 is vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter, subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag.
Original NVD description (English source)
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in `csettings.cfc` does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or link that, when visited by a logged-in administrator, triggers the silent creation of a comprehensive site bundle. This bundle is saved to a predictable, publicly accessible web directory. An unauthenticated attacker can then retrieve the bundle and obtain site content, user account data, password hashes, form submissions, email lists, plugins, and configuration data. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, remove unexpected bundle files from public directories, restrict access to the affected endpoint, and limit exposure of administrative sessions.