SB2026110649 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110649

SB2026110649 - Multiple vulnerabilities in Craft CMS

Published: November 6, 2026

Security Bulletin ID SB2026110649
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an attacker who can author entry type title formats to execute arbitrary server-side code.

The vulnerability exists due to an incomplete class blocklist in Craft CMS's non-sandboxed template renderer when processing attacker-authored title formats. An attacker who can author entry type title formats can use ZipArchive or XMLWriter to write arbitrary content to arbitrary paths, achieving remote code execution when the destination is the web document root.


2) Incorrect comparison (CVE-ID: N/A)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary PHP code on a Craft CMS server.

The vulnerability exists due to incorrect null checks in image transform validation when class is null and __class selects another PHP class. An unauthenticated remote attacker can use a public site user's profile photo accessor during sandboxed rendering of Craft Commerce's signed redirect parameter at payments/pay to instantiate an attacker-selected class.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a low-privilege control panel user to execute JavaScript in an administrator’s browser session.

The vulnerability exists due to unescaped rendering of a cached licensed-domain string in the Craft CMS control panel’s license-mismatch warning. A low-privilege control panel user can submit a malicious license string through app/process-api-response-headers to poison the cache, causing stored JavaScript to execute when an administrator opens the control panel.


4) Least Privilege Violation (CVE-ID: N/A)

CWE-ID: CWE-272 - Least Privilege Violation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an attacker with an active account session to retain access after two-factor authentication is enabled and disable it without re-authentication.

The vulnerability exists due to missing session invalidation and re-authentication checks in Craft CMS account security settings when two-factor authentication is enabled or removed. An attacker with an active account session can continue using that session and remove the victim’s second factor without knowing their password or authentication codes.


Remediation

Install update from vendor's website.

References