Threat Intelligence Database

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadget, to execute arbitrary code.

Craft CMS versions 5.0.0 up to but not including 5.10.14 contain a DOM-based cross-site scripting (XSS) vulnerability in the control panel login and two-factor authentication (2FA) verification flow. This vulnerability arises because a user-controlled returnUrl parameter accepts javascript: URLs, which are used in client-side navigation. An attacker can exploit this by tricking a 2FA-enabled user into opening a crafted URL during the login process, leading to execution of arbitrary JavaScript in the authenticated control panel context.

Craft CMS versions from 5.0.0 up to but not including 5.10.14 contain a missing authorization vulnerability in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user with low privileges to change the installed edition of the CMS persistently by calling the action route. This downgrade affects the project configuration and cannot be reversed by administrators through the control panel.

Craft CMS versions from 5.10.2 up to but not including 5.10.14 contain a vulnerability in the Twig template engine sandbox. This flaw allows non-admin users with the System Messages permission to bypass sandbox restrictions and invoke PHP callables, potentially executing arbitrary code as the web user. The vulnerability arises from improper neutralization of special elements used in templates, specifically via the "has some" and "has every" operators. The CVSS 4.0 score is 8.7, indicating a high severity issue.

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create('DOMDocument').loadHTMLFile() with textContent to expose local file contents to non-admin users who can view entries.

LavaLite CMS versions up to 10.1.2 contain an authorization bypass vulnerability that allows authenticated users with low privileges to modify other users' accounts, including administrators. This is achieved by exploiting a flaw in the AbstractRequest isWorkflow() check via a PATCH request to the user update route. The vulnerability enables changes to sensitive account attributes such as name, email, password, status, and mobile number.

CVE-2026-108900 is a medium severity SQL injection vulnerability in Exponent CMS versions 3.0.2patch1 and 3.0.2patch2. The flaw exists in the userLogin function of the xmlrpc.php file within the XML-RPC component. This vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The exploit code has been publicly disclosed. The vendor has not responded to the disclosure and no official patch or remediation guidance is currently available.

Feehi CMS version 2.1.1 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The vulnerability arises because the private-IP validation does not block loopback or link-local addresses, enabling an attacker to make the server send HTTP requests to internal services. This could lead to unauthorized information disclosure from internal network resources.

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.

Craft CMS versions 5.10.0 through 5.10.12 contain a vulnerability allowing authenticated low-privilege control panel users with edit rights on a single element type to execute arbitrary PHP code via server-side template injection. This occurs due to an incomplete fix for a previous vulnerability, where the unsandboxed sink in the code remained exploitable. The issue is resolved in version 5.10.13.