craftcms has 71 CVEs on record between 2025 and 2026. Cadence is steady at roughly 37 per quarter. The busiest recent month was August 2026 with 20. The median CVSS is 7.2 (high), with 5 rated critical. 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-94 (12) and CWE-862 (8). Most affected products: cms (31), craftcms/cms (30), craft_cms (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —(1)
- Last 90 days
- 37 prev 26
Weakness classes
Products
- cms 31
- craftcms/cms 30
- craft_cms 7
- commerce 1
- craftcms/commerce 1
- craftcms/commerce-mollie 1
Worst active — by depth score
CVE-2025-32432Critical· 10.0Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond100CVE-2026-92592High· 8.8Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bou…61CVE-2026-79987High· 8.8A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.61CVE-2026-72781High· 8.8Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism61CVE-2026-72778High· 8.8Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling61
craftcms vulnerabilities
CVEs affecting craftcms, newest first. Open any entry for full detail, references, and exploit status.
71 CVEsRSS
CVE-2026-50284HighCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
CVE-2026-55791CriticalCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
GHSA-78vr-q6cf-c7p6MediumCraft Commerce: Partial Payment Amount Without Lower Bound Validation
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
CVE-2026-32267HighCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
CVE-2026-29113Medium· 4.3Craft is a content management system (CMS)
Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action …
CVE-2025-68456Critical· 9.1Craft is a platform for creating digital experiences
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resour…
CVE-2025-68455High· 7.2Craft is a platform for creating digital experiences
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers mu…
CVE-2025-68454High· 8.8Craft is a platform for creating digital experiences
Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have admini…
CVE-2025-68437Medium· 6.8Craft is a platform for creating digital experiences
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeName>_Asset` mutation is vulnerable to Server-Side Request Forgery (SSRF). This …
CVE-2025-68436Medium· 6.5Craft is a platform for creating digital experiences
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo …
CVE-2025-32432Critical· 10.0CISA KEVPoCCraft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to r…