Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, the SSRF validation in Craft CMS’s GraphQL Asset mutation performs DNS resolution separately from the HTTP request. This Time-of-Check-Time-of-Use (TOCTOU) vulnerability enables DNS rebinding attacks, where an attacker’s DNS server returns different IP addresses for validation compared to the actual request. This is a bypass of the security fix for CVE-2025-68437 that allows access to all blocked IPs, not just IPv6 endpoints. Exploitation requires GraphQL schema permissions for editing assets in the `<VolumeName>` volume and creating assets in the `<VolumeName>` volume. These permissions may be granted to authenticated users with appropriate GraphQL schema access and/or Public Schema (if misconfigured with write permissions). Versions 4.16.19 and 5.8.23 patch the issue.
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `html` column type. The application fails to sanitize the input, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field. In order to exploit the vulnerability, an attacker must have an administrator account, and `allowAdminChanges` must be enabled in production, which is against Craft's security recommendations. Versions 4.16.19 and 5.8.23 patch the issue.
CVE-2026-25498 is a high-severity Remote Code Execution (RCE) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It arises from unsafe reflection due to insufficient sanitization of user-supplied configuration data in the assembleLayoutFromPost() function, allowing authenticated administrators to inject malicious Yii2 behavior configurations.
CVE-2026-25497 is a high-severity privilege escalation vulnerability in Craft CMS versions from 4.0.0-RC1 up to before 4.17.0-beta.1 and 5.9.0-beta.1. It affects the GraphQL API, specifically the saveAsset mutation, allowing an authenticated user with write access to one asset volume to modify or transfer assets in other volumes without proper authorization checks.
CVE-2026-25496 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The issue arises because the Prefix and Suffix fields in the Number field type settings are rendered using the raw Twig filter without proper escaping, allowing malicious scripts to execute when these fields are displayed on user profiles.
CVE-2026-25495 is a high-severity SQL Injection vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The flaw exists in the element-indexes/get-elements endpoint, specifically via the criteria[orderBy] parameter in the JSON request body, which is not properly sanitized before being used in an SQL ORDER BY clause.
CVE-2026-25494 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The vulnerability arises because the saveAsset GraphQL mutation uses PHP's filter_var function with FILTER_VALIDATE_IP to block certain IP addresses, but this function does not recognize alternative IP notations such as hexadecimal or mixed formats.
CVE-2026-25493 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The vulnerability arises because the saveAsset GraphQL mutation attempts to block SSRF by validating the initial URL hostname and resolved IP against a blocklist, but the underlying HTTP client (Guzzle) follows redirects by default.
CVE-2026-25492 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21. It arises from the save_images_Asset GraphQL mutation, which improperly validates hostnames and allows fetching internal URLs by resolving domain names to internal IP addresses.
CVE-2026-25491 is a stored cross-site scripting (XSS) vulnerability in CraftCMS versions from 5.0.0-RC1 up to 5.8.21. The vulnerability arises because Entry Type names are not properly sanitized when displayed in the Entry Types list, allowing malicious scripts to be stored and executed in the context of the CMS interface. This flaw requires authenticated users with privileges to create or modify Entry Types and some user interaction to trigger the payload. The vulnerability has a low CVSS score of 1.9 and is fixed in version 5.8.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the Store Management section are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Name & Description fields in Tax Zones are not properly sanitized before being displayed in the admin panel. This issue has been patched in versions 4.10.1 and 5.5.2.
CVE-2026-25488 is a stored Cross-Site Scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Tax Categories (Name & Description) fields in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25487 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper sanitization of the Tax Rates 'Name' field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25486 is a stored cross-site scripting (XSS) vulnerability affecting Craft Commerce versions 5.0.0 through 5.5.1. The flaw arises from improper sanitization of the Shipping Methods Name field in the Store Management section, allowing attackers to inject malicious JavaScript that executes in an administrator's browser. Exploitation requires the attacker to have high privileges to input data and some user interaction by an admin to trigger the payload. The vulnerability has been patched in version 5.5.2.
CVE-2026-25485 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The flaw arises from improper sanitization of the Shipping Categories fields (Name & Description) in the Store Management admin panel, allowing attackers to inject malicious JavaScript that executes in an administrator's browser.
CVE-2026-25484 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises because product type names are not properly sanitized when displayed in the CMS user permissions settings, allowing malicious scripts to be stored and executed.
CVE-2026-25483 is a stored cross-site scripting (XSS) vulnerability in Craft Commerce versions 4.0.0-RC1 to 4.10.0 and 5.0.0 to 5.5.1. The vulnerability arises from improper input neutralization in the Order Status History Message, which is rendered with a filter allowing raw HTML, enabling malicious script execution.