Description Summary:
Craft CMS versions prior to 5.10.11 contain an authorization flaw allowing authenticated users with specific permissions to reset administrator passwords and achieve full control-panel takeover.

Executive Summary:
A critical authorization bypass in Craft CMS allows authenticated users with administrative permissions to escalate privileges and gain full control over the application.

Vulnerability Details

CVE-ID: CVE-2026-84801

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to (excluding) 5.10.11

Vulnerability: The application fails to perform adequate authorization checks within the actionGetPasswordResetUrl and actionSetPassword endpoints. An attacker with existing administrateUsers permissions can generate password reset tokens for administrator accounts, effectively bypassing session validation to hijack administrative sessions.

Business Impact

The ability to perform a complete control-panel takeover represents a significant risk to organizational integrity and data confidentiality. With a CVSS score of 8.8, this high-severity vulnerability allows an attacker to gain full administrative access, leading to potential data exfiltration, unauthorized configuration changes, and complete compromise of the underlying application infrastructure.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.11 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review system access logs for unusual password reset activity or unauthorized administrative logins occurring outside of standard operational windows.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to monitor and block abnormal requests targeting the actionGetPasswordResetUrl and actionSetPassword endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for an attacker to possess the administrateUsers permission, though the impact of such access is total.

Analyst Recommendation

Given the potential for complete administrative takeover, this vulnerability poses a severe threat to any organization utilizing Craft CMS. Administrators must prioritize patching their environments to version 5.10.11 or higher. Until the update is applied, ensure that account permissions are strictly audited and limited to trusted personnel to reduce the surface area for potential exploitation.

Description Summary:
Craft CMS contains a site scope bypass vulnerability in GraphQL mutation resolvers that fails to validate site identifiers, allowing unauthorized modification of entries across different sites.

Executive Summary:
A high-severity site scope bypass vulnerability in Craft CMS allows authenticated users to read, modify, or delete entries across unauthorized sites via GraphQL mutations.

Vulnerability Details

CVE-ID: CVE-2026-84796

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to (excluding) 5.10.11

Vulnerability: This is an authorization bypass flaw (CWE-639) occurring within the GraphQL entry mutation resolvers. It requires an authenticated user to provide a manipulated siteId argument to ArgumentManager::prepareArguments(), which fails to validate the scope of the provided token against the requested site.

Business Impact

The ability for a low-privileged or site-scoped user to manipulate data across an entire CMS installation poses a significant threat to data integrity and confidentiality. With a CVSS score of 8.8, this flaw represents a high risk of unauthorized data modification or deletion, which could lead to severe operational disruption, loss of proprietary content, or compromise of multi-tenant site isolation.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.11 or later to implement the necessary validation logic in the GraphQL mutation resolvers.

Proactive Monitoring: Review web server and application audit logs for unusual GraphQL mutation requests, specifically monitoring for unexpected siteId values originating from standard user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block GraphQL mutation requests that contain suspicious or unauthorized siteId parameters if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the failure of the application to enforce logical boundaries between sites, making it a critical priority for environments hosting multiple sites within a single Craft CMS instance.

Analyst Recommendation

Given the potential for unauthorized data manipulation across sites, organizations running Craft CMS versions 5.x must treat this as a high-priority security update. Administrators should verify their current version and apply the patch to 5.10.11 immediately to ensure proper authorization enforcement for all GraphQL entry operations.

Description Summary:
Craft CMS versions prior to 5.10.11 contain an improper privilege management flaw that allows unauthenticated attackers to inherit administrator privileges during user registration.

Executive Summary:
A critical privilege escalation vulnerability in Craft CMS allows unauthenticated attackers to gain administrative access by exploiting flawed registration logic, posing a severe risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2026-84795

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to (excluding) 5.10.11

Vulnerability: This vulnerability is caused by improper privilege management where the system fails to validate the admin flag during user registration. An unauthenticated attacker can register an account using the email address of a deactivated administrator to inherit their elevated privileges when public registration is enabled and email verification is disabled.

Business Impact

The exploitation of this vulnerability results in a full compromise of the administrative interface, granting attackers the ability to modify content, alter system settings, and potentially execute arbitrary code depending on the environment configuration. Given the CVSS score of 9.8, this flaw represents a critical threat to business operations, data confidentiality, and system integrity. Unauthorized administrative access can lead to significant reputational damage and the complete takeover of the affected web application.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.11 or later immediately to resolve the privilege inheritance flaw.

Proactive Monitoring: Review user registration logs for suspicious activity or unexpected account creation events that correlate with existing administrative email addresses.

Compensating Controls: Disable public user registration and ensure email verification is enabled as a mandatory security best practice until the update can be applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Sep 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently documented, the lack of authentication required makes this flaw highly attractive to attackers, necessitating immediate patching.

Analyst Recommendation

This vulnerability presents an extreme risk due to the ease with which an attacker can escalate privileges without requiring prior authentication. Organizations utilizing Craft CMS must prioritize updating to version 5.10.11 immediately. Failure to address this issue leaves the application vulnerable to complete unauthorized administrative takeover.

Description Summary:
Craft CMS GraphQL entry mutation resolvers fail to enforce site-scope filtering, allowing authenticated attackers to modify or delete content across unauthorized sites.

Executive Summary:
A high-severity authorization bypass vulnerability in Craft CMS allows authenticated attackers to perform unauthorized cross-site content manipulation, including reading, updating, and deleting entries.

Vulnerability Details

CVE-ID: CVE-2026-79990

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to 5.10.11

Vulnerability: The GraphQL entry mutation resolvers (saveEntry and deleteEntry) fail to pass the siteId argument through the required security validation function, prepareArguments. This oversight allows an authenticated user with limited site-specific access to bypass scope restrictions and manipulate data in unauthorized sites.

Business Impact

The ability to manipulate content across sites poses a significant risk to data integrity and confidentiality. Attackers can exfiltrate sensitive information from restricted site segments or cause widespread service disruption by deleting global entries. With a CVSS score of 8.7, this flaw represents a critical threat to multi-site installations where strict administrative boundaries are required for compliance and operational security.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.11 or later immediately to apply the necessary security patches to the GraphQL mutation resolvers.

Proactive Monitoring: Review GraphQL access logs for unusual mutation activity, specifically focusing on requests where the siteId parameter references sites outside the scope of the authenticated user.

Compensating Controls: If immediate patching is not feasible, restrict access to the GraphQL endpoint at the Web Application Firewall (WAF) level for all untrusted or low-privilege user accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically exploitable by any authenticated user, no weaponized exploit code has been identified in the wild.

Analyst Recommendation

Given the ease with which an authenticated attacker can bypass site-level authorization, organizations running multi-site Craft CMS instances must prioritize this update. Applying the patch is the only definitive way to restore proper site-scope filtering and prevent unauthorized cross-site data manipulation.

Description Summary:
Craft CMS contains an improper authorization vulnerability in the elements/save action allowing authenticated users to modify account passwords without proper validation or elevated session checks.

Executive Summary:
An improper authorization flaw in Craft CMS allows authenticated users to reset passwords, potentially leading to unauthorized account takeover and total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-79989

Affected Software: CraftCMS CMS

Affected Versions: 5.0.0-RC1 up to (excluding) 5.10.8

Vulnerability: The vulnerability resides in the elements/save action, where the UserPasswordValidator fails to restrict the newPassword field to authorized scenarios. This allows any authenticated user to change their own password, and users with the Edit users permission to change passwords for any user, including administrators.

Business Impact

This vulnerability poses a significant risk to organizational security by enabling unauthorized account takeover. An attacker who gains access to a low-privileged account can escalate their privileges to administrator status, leading to full control over the CMS, data exfiltration, or site defacement. With a CVSS score of 8.7, this high-severity flaw represents a critical threat to the confidentiality, integrity, and availability of the managed content and underlying infrastructure.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.8 or later immediately to apply the patch that enforces proper session verification and authorization checks.

Proactive Monitoring: Review administrative access logs for suspicious password change events or unusual user account modifications occurring outside of standard maintenance windows.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to inspect requests to the elements/save endpoint, although a direct software update remains the only definitive remediation.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of September 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable because it leverages a native application flow to bypass security controls, making it a high-value target for attackers seeking unauthorized access.

Analyst Recommendation

The ability for an authenticated user to reset passwords without current credentials is a severe oversight that directly facilitates account takeover attacks. Given the potential for full administrative compromise, organizations using affected versions of Craft CMS must prioritize patching to version 5.10.8. Failure to apply this update leaves the application susceptible to privilege escalation and should be treated as an immediate operational priority.

Description Summary:
A Twig sandbox configuration flaw in Craft CMS allows authenticated attackers to perform arbitrary code execution via the Yii framework.

Executive Summary:
An authenticated remote code execution vulnerability in Craft CMS allows attackers with control panel access to execute arbitrary code due to an insecure Twig sandbox configuration.

Vulnerability Details

CVE-ID: CVE-2026-79988

Affected Software: Craft CMS

Affected Versions: 4.0.0-RC1 up to 4.18.3, 5.0.0-RC1 up to 5.10.7

Vulnerability: This is a protection mechanism failure (CWE-693) where the Twig sandbox improperly allowlists classes, enabling access to dangerous Yii framework function-call gadgets. An authenticated user with permission to access the control panel can trigger this flaw by rendering a malicious Twig template.

Business Impact

Successful exploitation allows an attacker to achieve remote code execution on the underlying server, leading to total compromise of the application and its data. Given the CVSS score of 8.7, this represents a high-severity risk that could result in complete loss of confidentiality, integrity, and availability for the affected system.

Remediation Plan

Immediate Action: Update Craft CMS to version 4.18.3 or 5.10.7 immediately to apply the patch that restricts dangerous class access within the Twig sandbox.

Proactive Monitoring: Review application logs for suspicious template rendering activities or unauthorized access to the control panel by low-privileged user accounts.

Compensating Controls: Restrict access to the Craft CMS control panel to trusted administrative users only and utilize a Web Application Firewall to filter requests containing suspicious Twig syntax or payloads.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access to the control panel, the impact is severe, and the vulnerability is inherently exploitable by design given the lax class allowlisting.

Analyst Recommendation

Organizations running the affected versions of Craft CMS must prioritize patching to the latest versions. The ability for an authenticated user to achieve remote code execution presents a significant security risk that should be mitigated immediately to prevent potential system-wide compromise.

Description Summary:
Craft CMS contains an authenticated remote code execution vulnerability in control panel element-search condition handling, allowing attackers to execute commands as the web user.

Executive Summary:
Craft CMS is affected by an authenticated remote code execution vulnerability that allows attackers to achieve full system command execution.

Vulnerability Details

CVE-ID: CVE-2026-78416

Affected Software: Craft CMS

Affected Versions: 4.0.0-RC1 up to 4.18.2, 5.0.0-RC1 up to 5.10.6

Vulnerability: This vulnerability involves a bypass of JSON cleansing mechanisms in condition configuration, allowing authenticated users to inject Yii behavior or event configuration keys that result in remote code execution.

Business Impact

Successful exploitation allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server process. This poses a severe risk of total system compromise, data theft, and unauthorized persistence. Given the CVSS score of 8.7, this vulnerability represents a high-severity threat that must be addressed to maintain the integrity of the hosting environment.

Remediation Plan

Immediate Action: Update Craft CMS to version 4.18.2 or 5.10.6 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review web server access logs for anomalous requests to the control panel or unexpected execution of system-level utilities.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter suspicious JSON payloads targeting control panel endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to its potential for remote code execution.

Analyst Recommendation

The ability for an authenticated user to gain arbitrary command execution is a critical security failure. Administrators must prioritize updating to the specified patched versions to eliminate this vulnerability and prevent potential lateral movement or full system takeover.

Description Summary:
Craft CMS is affected by a Twig sandbox escape vulnerability, which allows an authenticated attacker to execute arbitrary code on the server.

Executive Summary:
An authenticated remote code execution vulnerability in Craft CMS poses a critical risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-72781

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to 5.10.7, 4.0.0-RC1 up to 4.18.3

Vulnerability: This vulnerability involves a failure of the Twig sandbox protection mechanism (CWE-693). An authenticated user with sufficient privileges can bypass sandbox restrictions to perform arbitrary code execution on the host server.

Business Impact

Successful exploitation allows an attacker to gain full control over the web server. This facilitates unauthorized access to sensitive application data, potential lateral movement within the hosting environment, and complete system compromise. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.7 or 4.18.3 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs and system process execution for unusual activity originating from administrative or user accounts.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the web server process from executing unnecessary system commands or accessing sensitive filesystem areas.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, which limits the initial attack surface to existing users.

Analyst Recommendation

Given the severity of potential remote code execution, organizations must prioritize patching their Craft CMS instances. Administrative teams should verify their current version and apply the recommended updates immediately to prevent exploitation of this sandbox escape.

Description Summary:
Craft CMS is vulnerable to remote code execution due to improper control of dynamically determined object attributes during configuration processing.

Executive Summary:
An authenticated remote code execution vulnerability in Craft CMS allows attackers to manipulate object attributes and compromise the application.

Vulnerability Details

CVE-ID: CVE-2026-72778

Affected Software: Craft CMS

Affected Versions: 5.0.0-RC1 up to 5.10.6, 4.0.0-RC1 up to 4.18.2

Vulnerability: This issue is caused by improper control of dynamically determined object attributes (CWE-915). An authenticated attacker can leverage this flaw to modify application configurations and achieve arbitrary code execution.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. Exploitation enables an attacker to execute arbitrary commands, potentially leading to data exfiltration, unauthorized modification of site content, and complete loss of server control.

Remediation Plan

Immediate Action: Update Craft CMS to version 5.10.6 or 4.18.2 to resolve the configuration injection flaw.

Proactive Monitoring: Review application configuration change logs and monitor for unexpected administrative actions that could indicate an attempt to exploit object attributes.

Compensating Controls: Utilize a Web Application Firewall to block suspicious requests containing unexpected object attribute modifications or configuration parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authentication, it provides a direct path to full system control.

Analyst Recommendation

This vulnerability represents a significant security risk for Craft CMS installations. Administrators should perform an immediate update to the patched versions provided by the vendor to eliminate the potential for remote code execution.

Description Summary:
Craft CMS versions 5 and later contain a security vulnerability that may expose the system to unauthorized access or manipulation.

Executive Summary:
Craft CMS versions 5 and later are affected by a high-severity security vulnerability that poses a significant risk to the integrity and confidentiality of the content management system.

Vulnerability Details

CVE-ID: CVE-2026-56382

Affected Software: Craft CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects Craft CMS (composer package craftcms/cms) versions 5 and above. The specific nature of the flaw requires administrators to review vendor-provided security patches to understand the exact entry point and required authentication context.

Business Impact

With a CVSS score of 7.2, this vulnerability represents a high risk to business operations. Exploitation could lead to unauthorized access to sensitive site data, potential content modification, or administrative privilege escalation, resulting in significant reputational damage and potential loss of data integrity for organizations relying on the platform.

Remediation Plan

Immediate Action: Review the official Craft CMS security advisories and apply the latest security patches to all affected installations immediately.

Proactive Monitoring: Monitor server access logs and application logs for unusual administrative activity or unauthorized file modification attempts.

Compensating Controls: Implement strict firewall rules and limit access to the administrative control panel to trusted IP addresses only until the patch is deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 22, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of content management systems, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, organizations must prioritize patching their Craft CMS environments. Failure to update the software promptly could leave the platform exposed to sophisticated attacks that leverage this vulnerability to gain unauthorized control over the CMS instance.

Description Summary:
Craft CMS is vulnerable to a security flaw that could potentially lead to unauthorized system access or data compromise.

Executive Summary:
A high-severity security vulnerability in Craft CMS requires immediate attention to prevent potential unauthorized access and compromise of the content management system.

Vulnerability Details

CVE-ID: CVE-2026-55794

Affected Software: Craft CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in Craft CMS that may allow an attacker to bypass security controls. While authentication requirements are not explicitly defined, such flaws in CMS environments often permit unauthenticated or low-privileged interaction.

Business Impact

The exploitation of this vulnerability could result in unauthorized access to administrative functions, leading to data exfiltration or total system compromise. With a CVSS score of 8.7, this vulnerability represents a high risk to organizational integrity and confidentiality, potentially leading to severe reputational damage.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor as soon as they become available.

Proactive Monitoring: Review web server and application access logs for anomalous request patterns or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets to detect and block common attack vectors targeting the CMS.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, administrators must prioritize the identification and mitigation of this flaw. Ensure all Craft CMS instances are updated to the latest secure version immediately to close the identified security gap and maintain system hardening.

Description Summary:
Craft Commerce before 5.5.3 contains a SQL injection vulnerability in the inventory levels endpoint, allowing authenticated attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in Craft Commerce allows authenticated attackers to potentially compromise the entire backend database.

Vulnerability Details

CVE-ID: CVE-2026-29174

Affected Software: Craft CMS Craft Commerce

Affected Versions: >= 5.0.0 < 5.5.3

Vulnerability: The application is vulnerable to SQL injection due to improper sanitization of the sort[0][direction] and sort[0][sortField] parameters. This flaw resides in the inventory levels table data endpoint and requires an attacker to possess authenticated access to the Commerce Inventory section.

Business Impact

The ability to perform SQL injection poses a severe risk to data integrity and confidentiality, as it may allow an attacker to read, modify, or delete sensitive ecommerce data. With a CVSS score of 8.8, the vulnerability is classified as High severity because it can lead to full database compromise. Such an event would likely result in significant business disruption, loss of customer trust, and potential regulatory non-compliance regarding data protection.

Remediation Plan

Immediate Action: Update the Craft Commerce plugin to version 5.5.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax associated with the Commerce Inventory section.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and filter malicious SQL injection patterns directed at administrative endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct manipulation of backend queries through insufficient parameter validation.

Analyst Recommendation

Given the high CVSS score and the potential for total database compromise, administrators should prioritize updating Craft Commerce to version 5.5.3 immediately. While the vulnerability requires authentication, the risk remains substantial in environments where internal user accounts may be compromised or where least privilege is not strictly enforced.

Description Summary:
Craft Commerce is susceptible to SQL injection via the purchasables table endpoint, allowing authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
An authenticated SQL injection vulnerability in Craft Commerce allows attackers to execute unauthorized database queries, posing a high risk to data integrity and system confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-29172

Affected Software: Craft CMS Craft Commerce

Affected Versions: craftcms commerce: >= 4.0.0 < 4.10.2, >= 5.0.0 < 5.5.3

Vulnerability: The vulnerability stems from improper neutralization of input within the sort parameter of the purchasables table endpoint. An authenticated attacker can inject arbitrary SQL into the ORDER BY clause because the application fails to perform whitelist validation on the column name provided.

Business Impact

Successful exploitation of this flaw allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.8, this vulnerability is considered high severity, as it provides a path for attackers to compromise the integrity of ecommerce transactions and sensitive customer information stored within the platform.

Remediation Plan

Immediate Action: Upgrade Craft Commerce to version 4.10.2 or 5.5.3 immediately to incorporate the required input validation fixes.

Proactive Monitoring: Review application and database logs for anomalous query patterns or unexpected SQL syntax errors originating from the purchasables endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL injection patterns in HTTP request parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of sanitization in the Yii2 query builder component.

Analyst Recommendation

The risk associated with this SQL injection vulnerability is significant due to the potential for total impact on data confidentiality and integrity. Security teams should prioritize patching the Craft Commerce plugin to the specified fixed versions to eliminate the underlying injection vector. If patching is not immediately feasible, ensure that access to the affected endpoints is restricted to authorized administrative personnel only.

Description Summary:
Craft CMS is vulnerable to remote code execution due to improper control of code generation. This high-impact, low-complexity flaw allows unauthenticated attackers to execute arbitrary system code.

Executive Summary:
A critical remote code execution vulnerability in Craft CMS is currently being actively exploited in the wild, posing an immediate threat to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-32432

Affected Software: Craft CMS

Affected Versions: craftcms cms: >= 3.0.0-RC1, < 3.9.15, >= 4.0.0-RC1, < 4.14.15, >= 5.0.0-RC1, < 5.6.17

Vulnerability: This is a code injection vulnerability (CWE-94) that permits an unauthenticated attacker to achieve remote code execution on the underlying host. The flaw is triggered via a low-complexity network attack vector that does not require user interaction or pre-existing privileges.

Business Impact

With a CVSS score of 9.5, this vulnerability represents an extreme risk to the organization. Successful exploitation grants an attacker full control over the affected server, potentially leading to unauthorized data exfiltration, total system compromise, and the deployment of ransomware or other malicious payloads.

Remediation Plan

Immediate Action: Update Craft CMS installations to version 3.9.15, 4.14.15, or 5.6.17 immediately to apply the necessary security patches.

Proactive Monitoring: Inspect web server logs for suspicious request patterns, particularly those involving unusual file uploads or command execution sequences, and monitor for unauthorized outbound network connections from the CMS host.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block malicious code injection attempts targeting the CMS, though this should be considered a temporary measure until the software is patched.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of March 20, 2026. The high EPSS score and the existence of multiple public proof-of-concept repositories confirm that this flaw is trivial to weaponize.

Analyst Recommendation

Given the confirmed active exploitation and the critical nature of remote code execution, this vulnerability demands immediate attention from all security and IT operations teams. Organizations must prioritize patching the affected Craft CMS instances above all other maintenance tasks to prevent imminent compromise.

Description Summary:
The CraftCMS vCard Plugin 1.0.0 is vulnerable to unauthenticated remote code execution via a deserialization flaw in the vCard download functionality.

Executive Summary:
An unauthenticated remote code execution vulnerability in the CraftCMS vCard Plugin 1.0.0 allows attackers to execute arbitrary PHP code via crafted serialized payloads.

Vulnerability Details

CVE-ID: CVE-2020-37071

Affected Software: CraftCMS vCard Plugin

Affected Versions: 1.0.0

Vulnerability: This is a deserialization of untrusted data vulnerability (CWE-502) that allows unauthenticated attackers to trigger remote code execution by sending a specially crafted request to the plugin's vCard download endpoint.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary code on the underlying server, leading to a complete compromise of the CMS and potentially the entire host environment. With a CVSS score of 9.8, this vulnerability poses a critical threat to the confidentiality and integrity of the application.

Remediation Plan

Immediate Action: Users should immediately uninstall or disable the vCard plugin if it is not business-critical until a verified security patch is released by the developer.

Proactive Monitoring: Inspect web access logs for requests to vCard download endpoints containing serialized PHP objects or suspicious character sequences.

Compensating Controls: Implement WAF rules to inspect and block incoming HTTP requests that contain serialized PHP structures (e.g., 'O:').

Exploitation Status

Public Exploit Available: Yes — a public exploit is available on ExploitDB and documented on GitLab.

Analyst Notes: As of Feb 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation without authentication.

Analyst Recommendation

Due to the critical nature of this remote code execution vulnerability and the presence of publicly available exploit code, immediate removal or restriction of the affected plugin is required. Organizations should treat this as a high-priority incident until the component is removed or patched.