Craft CMS vulnerabilities

A vulnerability in Craft CMS allows users with system email template editing permissions to read server files, including the .env file containing passwords and API keys. An attacker can escalate to full admin account takeover by forging session tokens.

Craft CMS versions 4.0.0-RC1 through 4.18.0 and 5.0.0-RC1 through 5.10.0 are vulnerable to SSRF and arbitrary JavaScript injection via the /actions/app/resource-js endpoint. An attacker can poison the Host or X-Forwarded-Host header to bypass URL validation and force the Guzzle client to fetch a malicious payload from an external server.

In Craft CMS versions 5.0.0-RC1 through 5.9.20, a vulnerability exists due to improper authorization in the EntriesController::actionMoveToSection() endpoint. An authenticated low-privileged user can move an entry to a section where they have only read access without the required write permissions, breaking the section-level authorization model.

In Craft CMS versions 5.0.0-RC1 through 5.9.20, a vulnerability allows bypassing permission checks when saving entries. A low-privileged user can change the author of an entry to another user without the required permissions, leading to authorship spoofing.

In Craft CMS versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can inject a JavaScript payload into a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget's 'Give feedback' screen and searches for a term that returns the poisoned issue, the payload executes in the admin's control panel session.

In Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, the folder deletion function does not enforce peer asset deletion permissions. A low-privilege user can delete folders and all contained assets, including those uploaded by other users.

Craft CMS has an authorization issue in AssetsController::actionReplaceFile that allows an authenticated user to delete a source asset without source delete permission. Affected versions are 5.0.0-RC1 through 5.9.20 and 4.0.0-RC1 through 4.17.13.

In Craft CMS versions 5.0.0-RC1 through 5.9.22, an author-level user can inject malicious JavaScript into an entry title. When an admin drags another entry under the poisoned entry in table view, the payload executes in the victim's session.

Craft CMS version 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence checks. Attackers can bypass extension validation by passing traversal sequences that resolve to existing SVG files, allowing local file read access.

Craft CMS versions 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multiple stored cross-site scripting vulnerabilities where settings names and field option labels are rendered without sanitization. An authenticated administrator can inject malicious payloads into section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels, causing arbitrary JavaScript to execute in other users' control-panel sessions.

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. This vulnerability allows low-privileged authenticated users to bypass view authorization for assets.

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset.

Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names are rendered without proper HTML escaping. Attackers with admin access can inject arbitrary JavaScript via the user group name field that executes when other users view or edit permissions.

Craft CMS before versions 4.17.3 and 5.9.7 has a CSRF issue in the preview token endpoint at /actions/preview/create-token. An attacker can force a logged-in editor to mint a preview token, which can then be used to access unpublished content.

Craft is a content management system (CMS) for creating custom digital experiences. Bypassing the validatePath function can lead to remote code execution, posing a risk of malicious control over vulnerable systems.

Craft CMS versions up to 4.4.9 are vulnerable to HTML Injection.

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

Craft is a content management system (CMS) for creating custom digital experiences. A cross-site scripting (XSS) vulnerability can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Craft is a CMS for creating custom digital experiences on the web. The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

Craft is a content management system (CMS) for creating custom digital experiences on the web. A cross-site scripting (XSS) vulnerability has been identified that can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

Craft CMS version 4.2.0.1 is vulnerable to Cross-Site Scripting (XSS) via the Drafts feature. An attacker can inject a malicious script that will be executed in the victim's browser.