Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enabled can include 'as X' or 'on X' keys that bypass cleanseConfig() to execute OS commands as the web user and disclose secrets.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event handlers that execute when the element query runs, achieving code execution as the web user.
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::createObject, attaching malicious behaviors or event handlers that execute code as the web user.
Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an array-callable such as FileHelper::writeToFile via element-select condition rules to write a webshell to the webroot and execute code as the web user.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contain a code injection vulnerability in the AppController::actionCacheUpdates method. This flaw allows authenticated control panel users with specific permissions to inject arbitrary code by manipulating the 'updates' request parameter without proper cleansing. The vulnerability enables execution of behavior and event-handler injection via crafted 'as' or 'on' keys.
Craft CMS versions 5.0.0 through before 5.10.14 contain a DOM-based cross-site scripting (XSS) vulnerability in the control panel login and two-factor authentication (2FA) verification flow. The vulnerability arises because a user-controlled returnUrl parameter accepts javascript: URLs, which are used in client-side navigation. An attacker can exploit this by tricking a 2FA-enabled user into opening a crafted URL during the login process, resulting in JavaScript execution within the authenticated control panel session.
Craft CMS versions from 5.0.0 up to but not including 5.10.14 have a missing authorization vulnerability in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user, including low-privileged front-end users, to change the installed edition of the CMS. Exploitation can cause a persistent downgrade of the site edition in the project configuration, which administrators cannot reverse through the control panel.
Craft CMS versions from 5.10.2 up to but not including 5.10.14 contain a vulnerability in the Twig sandbox that allows non-admin users with System Messages permission to execute arbitrary PHP code via specially crafted templates. This occurs through a sandbox bypass involving the 'has some' and 'has every' operators, enabling invocation of PHP callables such as passthru or system. The vulnerability has a high severity with a CVSS 4.0 score of 8.7.
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 have an arbitrary file read vulnerability. This occurs because the Twig create() class blocklist does not include DOMDocument, allowing attackers with certain privileges to read local files. Specifically, attackers able to set an entry-type title format, including via project-config/apply, can exploit this to expose local file contents to non-admin users who can view entries.
CVE-2026-108900 is a medium severity SQL injection vulnerability in Exponent CMS affecting versions 3.0.2patch1 and 3.0.2patch2. The flaw exists in the userLogin function of the xmlrpc.php file within the XML-RPC component. This vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The exploit has been publicly disclosed, but no vendor response or patch has been provided as of the publication date.
LavaLite CMS versions up to 10.1.2 have an authorization bypass vulnerability allowing authenticated low-privileged users to modify other users' accounts, including administrators, by exploiting a flaw in the AbstractRequest isWorkflow() check. This enables attackers to send PATCH requests to update user details such as name, email, password, status, or mobile number without proper authorization.
Feehi CMS version 2.1.1 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The vulnerability arises because the private-IP validation does not block loopback or link-local addresses, enabling an attacker to make the server send HTTP requests to internal services. This could lead to unauthorized information disclosure from internal network resources.
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), these fields are gated only on the elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element whose email, username, fullName, and addresses fields have no per-field authorization. A client holding only the drafts or revisions scope — including an unauthenticated client when the operator has enabled the public GraphQL schema with those scopes — can therefore harvest the email addresses, usernames, full names, and postal addresses of all draft/revision creators (typically site editors and administrators). The issue is fixed in 5.11.0.
Craft CMS versions 5.10.0 through 5.10.12 contain a vulnerability allowing authenticated low-privilege control panel users with edit rights on a single element type to execute arbitrary PHP code via server-side template injection. This occurs due to an incomplete fix for a previous vulnerability, where the unsandboxed sink in the code remained exploitable. The issue is resolved in version 5.10.13.
Craft CMS versions 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 contain a vulnerability where an authenticated non-administrator user can execute arbitrary operating system commands. This occurs due to improper binding of HMAC signatures to their purpose, allowing an attacker to reuse a signed cookie in a redirect parameter that is rendered as an unsandboxed Twig template. The issue requires password authentication without 2FA and availability of PHP system(). The vulnerability is fixed in versions 4.18.6 and 5.10.13.
Craft CMS versions 5.0.0 through 5.10.12 have a vulnerability where a database connection failure causes the system to treat the site as uninstalled. This exposes installer actions to unauthenticated users who have a valid guest session and CSRF token from before the outage. Attackers can exploit this to disclose sensitive environment variables and secrets such as security keys and database credentials. The vulnerability requires an independent database outage and is fixed in version 5.10.13.