Repository navigation
Security: craftcms/cms
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Unauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scopeGHSA-mp59-9rf5-93wr published
Oct 23, 2026 by angrybradModerate -
Anonymous GraphQL clients can read out-of-scope section contentGHSA-xpg7-m6gm-4xfh published
Oct 23, 2026 by angrybradModerate -
"app/icon-svg" reads arbitrary SVG content files from any path or aliasGHSA-5v62-pcq7-fxj9 published
Oct 23, 2026 by angrybradLow -
Public registration inherits direct permissions from a deactivated accountGHSA-v25r-wr32-jfg7 published
Oct 23, 2026 by angrybradModerate -
SQL injection leading to privilege escalationGHSA-qcvp-ggx3-97r6 published
Oct 22, 2026 by angrybradHigh -
Control panel only API response emulation replaces "securityKey" and reaches server RCEGHSA-9hp6-3565-gvh5 published
Oct 23, 2026 by angrybradHigh -
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEGHSA-v4q3-2g5g-wjj6 published
Oct 23, 2026 by angrybradHigh -
"app/render-elements" return URL signing oracle leads to RCEGHSA-qj3q-j7r4-428p published
Oct 23, 2026 by angrybradHigh -
Control panel only blind SQL injection through "getNext"/"getPrev" criteriaGHSA-f6gf-r952-rxg6 published
Oct 22, 2026 by angrybradHigh -
Control panel only administrator privilege escalation through sandbox allowed "getOwners(criteria)"GHSA-r56r-f696-c8w9 published
Oct 22, 2026 by angrybradHigh