Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a vulnerability in the Twig create() function where case-sensitive class-name checks allow bypass of input restrictions. This enables attackers with template-execution privileges to instantiate the SplFileObject class using a lowercase name, potentially reading sensitive .env files or writing PHP files to the webroot, leading to remote code execution.
Craft CMS versions from 5.0.0 up to but not including 5.11.0 contain an authorization bypass vulnerability. This flaw allows site-scoped GraphQL tokens to modify content on other sites by bypassing the requireAllowedSite() check. Attackers with a token scoped to one site can create or delete entries, categories, tags, and shared assets on other sites by specifying a different siteId.
Craft CMS versions 5.0.0 through before 5.11.0 contain an authentication bypass vulnerability where verification codes are not invalidated after use. This flaw allows attackers who obtain a victim's verification code to reuse it to reset the victim's password and take over their account. The issue is fixed in version 5.11.0.
Craft CMS versions from 5.8.0 up to but not including 5.11.0 contain a remote code execution vulnerability. Authenticated administrators can exploit this flaw by injecting Yii behaviors through a JSON-string field layout in ContentBlock::setFieldLayout(). This allows attackers with the allowAdminChanges setting enabled to bypass configuration cleansing and execute operating system commands as the web user, potentially disclosing sensitive information. The vulnerability is fixed in version 5.11.0.
Craft CMS versions from 5.0.0 up to but not including 5.11.0 contain a remote code execution vulnerability. Authenticated Control Panel users can bypass the Twig sandbox by supplying unfiltered criteria to certain element query methods, enabling injection of malicious Yii configuration keys that execute code as the web user. This flaw is fixed in version 5.11.0.
Craft CMS versions from 5.0.0 up to but not including 5.11.0 contain a remote code execution vulnerability. Authenticated Control Panel users can exploit this flaw to escape the Twig sandbox via Asset::getMimeType transforms by supplying malicious 'as' or 'on' keys that are passed unfiltered to Craft::createObject. This allows execution of arbitrary code with the web user's privileges. The vulnerability is fixed in version 5.11.0.
Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 have a vulnerability in the Twig sandbox allowlist. Authenticated Control Panel users can bypass sandbox restrictions using certain filters to access sensitive information such as security keys, database credentials, and authentication tokens.
Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a remote code execution vulnerability in the Twig group filter. Authenticated control panel users can exploit this flaw by passing array-callable arguments, such as FileHelper::writeToFile, to write and execute arbitrary code on the server as the web user.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contain a code injection vulnerability in the AppController::actionCacheUpdates method. This flaw allows authenticated control panel users with specific permissions to inject arbitrary code by manipulating the 'updates' request parameter without proper cleansing. The vulnerability enables execution of behavior and event-handler injection via crafted 'as' or 'on' keys.
Craft CMS versions 5.0.0 through before 5.10.14 contain a DOM-based cross-site scripting (XSS) vulnerability in the control panel login and two-factor authentication (2FA) verification flow. The vulnerability arises because a user-controlled returnUrl parameter accepts javascript: URLs, which are used in client-side navigation. An attacker can exploit this by tricking a 2FA-enabled user into opening a crafted URL during the login process, resulting in JavaScript execution within the authenticated control panel session.
Craft CMS versions from 5.0.0 up to but not including 5.10.14 have a missing authorization vulnerability in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user, including low-privileged front-end users, to change the installed edition of the CMS. Exploitation can cause a persistent downgrade of the site edition in the project configuration, which administrators cannot reverse through the control panel.
Craft CMS versions from 5.10.2 up to but not including 5.10.14 contain a vulnerability in the Twig sandbox that allows non-admin users with System Messages permission to execute arbitrary PHP code via specially crafted templates. This occurs through a sandbox bypass involving the 'has some' and 'has every' operators, enabling invocation of PHP callables such as passthru or system. The vulnerability has a high severity with a CVSS 4.0 score of 8.7.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 have an arbitrary file read vulnerability. This occurs because the Twig create() class blocklist does not include DOMDocument, allowing attackers with certain privileges to read local files. Specifically, attackers able to set an entry-type title format, including via project-config/apply, can exploit this to expose local file contents to non-admin users who can view entries.
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
Craft CMS versions 5.10.0 through 5.10.12 contain a vulnerability allowing authenticated low-privilege control panel users with edit rights on a single element type to execute arbitrary PHP code via server-side template injection. This occurs due to an incomplete fix for a previous vulnerability, where the unsandboxed sink in the code remained exploitable. The issue is resolved in version 5.10.13.
Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a vulnerability where an authenticated non-administrator user can execute arbitrary operating system commands. This occurs due to improper binding of HMAC signatures to their purpose, allowing an attacker to reuse a signed cookie in a redirect parameter that is rendered as an unsandboxed Twig template. The issue requires password authentication without 2FA and availability of PHP system(). The vulnerability is fixed in versions 4.18.6 and 5.10.13.
Craft CMS versions 5.0.0 through 5.10.12 have a vulnerability where a database connection failure causes the system to treat the site as uninstalled. This exposes installer actions to unauthenticated users who have a valid guest session and CSRF token from before the outage. Attackers can exploit this to disclose sensitive environment variables and secrets such as security keys and database credentials. The vulnerability requires an independent database outage and is fixed in version 5.10.13.
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users viewing element indexes.
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `manageNestedElements::<ownerId>::field:<handle>` authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to.
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUser. As a result, an authenticated control panel user who is not an administrator but holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account, which can lead to permission escalation when combined with resetting that account's password. The issue is fixed in Craft CMS 5.10.12.