Craft CMS
Vulnerability activity for Craft CMS: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 10.0CriticalMar 20, 2026Craft CMS Code / command injectionCVE-2025-32432Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.Added to KEV Mar 20, 2026Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.3CriticalDec 18, 2024Craft CMS Code / command injectionCVE-2024-56145Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.Added to KEV Jun 2, 2025 · 165 days after publicationExploited97% likelyExploit codeMetasploit · NucleiDetection
- 5.3MediumMay 7, 2025Craft CMSCVE-2025-35939Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.Added to KEV Jun 2, 2025 · 25 days after publicationExploited1.3% likely
- 8.1HighJan 18, 2025Craft CMS Code / command injectionCVE-2025-23209Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.Added to KEV Feb 20, 2025 · 33 days after publicationExploited22% likely
Recent
- –UnscoredOct 26, 2026Craft CMSADV-cccs-be3d305a6ed6Serial number: AV26-1086 Date: October 26, 2026 As of October 23, 2026, Craft CMS is affected by vulnerabilities in the following products: CMS Prior to 4.18.9 Prior to 5.11.2 Commerce-mollie Prior to 4.4.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. craftcms/cms 5.11.2 craftcms/commerce-mollie 4.4.3 Craft CMS Seccurity Advisories
- –UnscoredOct 20, 2026Craft CMSADV-cccs-5ece947adcd2Serial number: AV26-1067 Date: October 20, 2026 As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product: Craft CMS Prior to 4.18.8 Prior to 5.11.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Authenticated RCE via Twig group filter array-callable Twig sandbox allowlist bypass discloses sensitive values Authenticated RCE: Twig sandbox "on/as" behavior injection via
- 10.0CriticalMar 20, 2026Craft CMS Code / command injectionCVE-2025-32432Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 5.3MediumMay 7, 2025Craft CMSCVE-2025-35939Craft CMS contains an external control of assumed-immutable web parameter vulnerability. This vulnerability could allow an unauthenticated client to introduce arbitrary values, such as PHP code, to a known local file location on the server. This vulnerability could be chained with CVE-2024-58136 as represented by CVE-2025-32432.Exploited1.3% likely
- 9.3CriticalDec 18, 2024Craft CMS Code / command injectionCVE-2024-56145Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has `register_argc_argv` enabled.Exploited97% likelyExploit codeMetasploit · NucleiDetection
- 8.1HighJan 18, 2025Craft CMS Code / command injectionCVE-2025-23209Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution.Exploited22% likely
Top products
- Craft CMS1 CVE in the last year, 1 critical, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 26, 2026Craft CMS security advisory (AV26-1086)ADV-cccs-be3d305a6ed6
- CCCS (Canada) · Oct 20, 2026Craft CMS security advisory (AV26-1067)ADV-cccs-5ece947adcd2
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.