Threat Intelligence Database

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

Craft CMS versions from 5.0.0 up to but not including 5.11.0 contain an authentication bypass vulnerability. This flaw allows attackers to reuse email verification codes because the users/verify-email endpoint does not invalidate these codes for active users. An attacker who obtains a victim's emailed verification code can use it to reset the victim's password via the users/set-password endpoint after the victim verifies an email change, leading to account takeover.

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a remote code execution vulnerability in the Twig group filter. Authenticated control panel users can exploit this flaw by passing array-callable arguments, such as FileHelper::writeToFile, to write a webshell to the webroot and execute arbitrary code as the web user. This vulnerability arises because the filter invokes non-string arrow arguments as callables without proper safeguards.

Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contain a code injection vulnerability in the AppController::actionCacheUpdates method. This flaw allows authenticated control panel users with specific permissions to inject arbitrary code by manipulating the 'updates' request parameter without proper cleansing. The vulnerability enables execution of behavior and event-handler injection via crafted 'as' or 'on' keys.