CVE-2025-55040: MuraCMS · The Import Form CSRF
Source CVE Database V5
Not known to be exploited · CVSS 8.8 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- MuraCMS through 10.1.10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitation evidence
Disclosed: evidence found.
CVE published 18 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-55040, organizations should implement the following specific measures: 1) Apply any available patches or updates from MuraCMS that address CSRF protections in the import form functionality. 2) If patches are unavailable, implement web application firewall (WAF) rules to detect and block suspicious POST requests to the import form endpoint, especially those lacking valid CSRF tokens or originating from untrusted referrers. 3) Enforce strict administrative session management, including multi-factor authentication (MFA) and session timeouts, to reduce the risk of session hijacking and unauthorized access. 4) Educate administrators to avoid visiting untrusted or suspicious websites while logged into the CMS to prevent inadvertent interaction with malicious CSRF exploit pages. 5) Restrict file upload permissions and validate uploaded form definitions rigorously on the server side to detect and reject malicious content. 6) Monitor CMS logs for unusual form import activities and conduct regular security audits to detect unauthorized form installations. 7) Consider implementing Content Security Policy (CSP) headers to limit the execution of malicious scripts that could facilitate CSRF attacks. These targeted steps go beyond generic advice by focusing on the specific attack vector and administrative user behavior involved in this vulnerability.
Description
The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker-controlled forms when an authenticated administrator visits a crafted webpage. Full exploitation of this vulnerability would require the victim to select a malicious ZIP file containing form definitions, which can be automatically generated by the exploit page and used to create data collection forms that steal sensitive information. Successful exploitation of the import form CSRF vulnerability could result in the installation of malicious data collection forms on the target MuraCMS website that can steal sensitive user information. When an authenticated administrator visits a malicious webpage containing the CSRF exploit and selects the attacker-generated ZIP file, their browser uploads and installs form definitions that create legitimate forms that could be designed with malicious content.