SB2026072922 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072922

SB2026072922 - Multiple vulnerabilities in Craft CMS

Published: July 29, 2026

Security Bulletin ID SB2026072922
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 17% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: N/A)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the control panel element-search condition handling when processing a request containing a crafted condition.config JSON string. A remote user can send a specially crafted request to execute arbitrary code.

A valid control panel session and CSRF token are required. Command execution is semi-blind and may be confirmed through a server-side file-write side effect retrieved in a subsequent request.


2) Incomplete List of Disallowed Inputs (CVE-ID: N/A)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incomplete list of disallowed inputs in the create() Twig function when instantiating arbitrary PHP classes from non-sandboxed template contexts. A remote user can configure a crafted entry type title format using SplFileObject to disclose sensitive information.

Exploitation requires admin access to the control panel, allowAdminChanges to be enabled, and the ability to edit entry type settings. The issue does not affect sandboxed template contexts.


3) Exposure of Resource to Wrong Sphere (CVE-ID: N/A)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to exposure of sensitive resources in the Twig template rendering functionality when processing a crafted `elementId` parameter that interpolates environment variable references. A remote user can render a malicious sandboxed Twig template and use repeated error-based requests to disclose sensitive information.

Exploitation requires permission to access the control panel and can occur even when the Twig sandbox is enabled through `enableTwigSandbox()`.


4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to access files outside the intended directory.

The vulnerability exists due to path traversal in the ensurePathIsContained function of the Local file system class when constructing and normalizing file paths for file reads. A local user can supply a crafted path to access files outside the intended directory.

No exploitable scenario has been discovered, and the issue is described as theoretical.


5) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery and disclose internal HTTP response content.

The vulnerability exists due to improper access control in the GraphQL asset mutation when fetching an attacker-supplied URL server-side. A remote user can provide a crafted URL to trigger internal requests and disclose internal HTTP response content.

The issue affects GraphQL tokens scoped only to asset creation, and different error and timing outcomes can expose an oracle for blind internal host and port enumeration.


6) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify category structure.

The vulnerability exists due to improper access control in the structures/move-element action when handling requests to move category elements. A remote user can send a crafted request to modify category structure.

This issue affects users with only view permission for a category group, allowing persistent reordering and re-parenting of categories that can change derived category and descendant URLs.


Remediation

Install update from vendor's website.

References