受影响的版本系列
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2025-35939 | Craft CMS stores user-provided content in session files | * | 6.9 | KEV | 1.4% | 2025-05-08 |
| CVE-2025-32432 | Craft CMS Allows Remote Code Execution | * | 10.0 | KEV | 99.8% | 2025-04-26 |
| CVE-2025-23209 | Potential RCE with a compromised security key in craft/cms | * | 8.1 | KEV | 21.6% | 2025-01-18 |
| CVE-2024-56145 | RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms | * | 9.3 | KEV | 97.5% | 2024-12-19 |
| CVE-2026-115934 | SQL injection leading to privilege escalation | ≥ 5.0.0 < 5.11.2 ≥ 4.0.0 < 4.18.9 | 9.3 | — | 2026-11-10 | |
| CVE-2026-124431 | Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement | ≥ 5.10.0 < 5.11.2 | 5.3 | — | 2026-11-08 | |
| CVE-2026-124429 | Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration | ≥ 5.0.0 < 5.11.2 | 8.7 | — | 2026-11-08 | |
| CVE-2026-124430 | Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle | ≥ 5.10.0 < 5.11.2 | 8.7 | — | 2026-11-08 | |
| CVE-2026-124428 | Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg | ≥ 5.7.0 < 5.11.2 | 7.1 | — | 2026-11-08 | |
| CVE-2026-124427 | Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next | ≥ 5.0.0 < 5.11.2 | 9.3 | — | 2026-11-08 | |
| CVE-2026-124426 | Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field | ≥ 5.0.0 < 5.11.2 | 6.9 | — | 2026-11-08 | |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select | ≥ 4.0.0 < 4.18.9 ≥ 5.0.0 < 5.11.2 | 8.8 | — | 2026-11-07 | |
| CVE-2026-123490 | Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass | ≥ 5.8.17 < 5.11.2 | 8.7 | — | 2026-11-07 | |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint | ≥ 4.0.0 < 4.18.9 ≥ 5.0.0 < 5.11.2 | 9.3 | — | 2026-11-07 | |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria | ≥ 4.0.0 < 4.18.9 ≥ 5.0.0 < 5.11.2 | 7.1 | — | 2026-11-07 | |
| CVE-2026-115938 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE | ≥ 5.0.0 < 5.11.2 ≥ 4.0.0 < 4.18.9 | 8.7 | — | 2026-10-24 | |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | ≥ 5.0.0 < 5.11.2 ≥ 4.0.0 < 4.18.9 | 8.7 | — | 2026-10-24 | |
| CVE-2026-112777 | Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE | ≥ 4.0.0 < 4.18.8 ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-112775 | Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password | ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-112776 | Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations | ≥ 5.0.0 < 5.11.0 | 9.3 | — | 2026-10-20 | |
| CVE-2026-112774 | Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout | ≥ 5.8.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-112773 | Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection | ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-112772 | Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection | ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-112771 | Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters | ≥ 4.0.0 < 4.18.8 ≥ 5.0.0 < 5.11.0 | 7.1 | — | 2026-10-20 | |
| CVE-2026-112770 | Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable | ≥ 4.0.0 < 4.18.8 ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-20 | |
| CVE-2026-109307 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | ≥ 5.0.0 < 5.10.14 | 2.1 | — | 2026-10-13 | |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | ≥ 4.0.0 < 4.18.7 ≥ 5.0.0 < 5.10.14 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109306 | Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition | ≥ 5.0.0 < 5.10.14 | 6.0 | — | 2026-10-13 | |
| CVE-2026-109305 | Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every | ≥ 5.10.2 < 5.10.14 | 8.7 | — | 2026-10-13 | |
| CVE-2026-109304 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument | ≥ 4.0.0 < 4.18.7 ≥ 5.0.0 < 5.10.14 | 6.9 | — | 2026-10-13 | |
| CVE-2026-105985 | Authenticated RCE via render-components Entry Type overrides | ≥ 5.0.0 < 5.11.0 | 8.7 | — | 2026-10-06 | |
| CVE-2026-92594 | Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL | ≥ 5.0.0-RC1 < 5.11.0 | 8.7 | — | 2026-09-17 | |
| CVE-2026-92593 | Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution | ≥ 5.10.0 < 5.10.13 | 8.7 | — | 2026-09-17 | |
| CVE-2026-92592 | Craft CMS before 4.18.6 Remote Code Execution via signed cookie | ≥ 4.8.0 < 4.18.6 ≥ 5.0.0 < 5.10.13 | 8.7 | — | 2026-09-17 | |
| CVE-2026-92591 | Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer | ≥ 5.0.0 < 5.10.13 | 8.2 | — | 2026-09-17 | |
| CVE-2026-92590 | Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields | ≥ 5.7.0 < 5.10.13 | 5.1 | — | 2026-09-17 | |
| CVE-2026-92589 | Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder | ≥ 5.0.0 < 5.10.13 | 5.3 | — | 2026-09-17 | |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | ≥ 5.8.0 < 5.10.13 | 8.7 | — | 2026-09-11 | |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | ≥ 5.0.0-RC1 < 5.10.12 | 8.7 | — | 2026-09-09 | |
| CVE-2026-86731 | Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController | ≥ 5.0.0-RC1 < 5.10.12 | 7.1 | — | 2026-09-09 | |
| CVE-2026-86730 | Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE | ≥ 5.0.0-RC1 < 5.10.12 | 8.7 | — | 2026-09-09 | |
| CVE-2026-79991 | Authenticated SQL Injection via nested eager-loading criteria | ≥ 5.0.0-RC1 < 5.10.13 | 7.1 | — | 2026-09-02 | |
| CVE-2026-79990 | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete | ≥ 5.0.0-RC1 < 5.10.11 | 8.7 | — | 2026-09-02 | |
| CVE-2026-79989 | Arbitrary user password reset leading to administrator account takeover | ≥ 5.0.0-RC1 < 5.10.8 | 8.7 | — | 2026-09-02 | |
| CVE-2026-84802 | Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController | ≥ 5.7.0 < 5.10.12 | 5.3 | — | 2026-09-02 | |
| CVE-2026-84801 | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers | ≥ 5.0.0-RC1 < 5.10.11 | 8.7 | — | 2026-09-02 | |
| CVE-2026-84800 | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file | ≥ 5.0.0-RC1 < 5.10.11 | 7.1 | — | 2026-09-02 | |
| CVE-2026-84799 | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations | ≥ 5.0.0-RC1 < 5.11.0 | 5.3 | — | 2026-09-02 | |
| CVE-2026-84798 | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite | ≥ 5.0.0-RC1 < 5.10.11 | 7.1 | — | 2026-09-02 | |
| CVE-2026-84797 | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate | ≥ 5.0.0-RC1 < 5.10.11 | 5.3 | — | 2026-09-02 | |
| CVE-2026-84796 | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass | ≥ 5.0.0-RC1 < 5.10.11 | 8.7 | — | 2026-09-02 | |
| CVE-2026-84795 | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance | ≥ 5.0.0-RC1 < 5.10.11 | 9.2 | — | 2026-09-02 | |
| CVE-2026-84794 | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset | ≥ 5.0.0-RC1 < 5.10.11 | 7.1 | — | 2026-09-02 | |
| CVE-2026-84793 | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name | ≥ 5.0.0-RC1 < 5.10.11 | 4.8 | — | 2026-09-02 | |
| CVE-2026-84792 | Craft CMS before 5.10.11 Broken Access Control via element-indexes | ≥ 5.0.0-RC1 < 5.10.11 | 5.3 | — | 2026-09-02 | |
| CVE-2026-79988 | Authenticated RCE through Twig sandbox escape | ≥ 4.0.0-RC1 < 4.18.3 ≥ 5.0.0-RC1 < 5.10.7 | 8.7 | — | 2026-08-28 | |
| CVE-2026-78416 | Authenticated RCE via `condition.config` JSON cleanse bypass | ≥ 4.0.0-RC1 < 4.18.2 ≥ 5.0.0-RC1 < 5.10.6 | 8.7 | — | 2026-08-25 | |
| CVE-2026-72787 | Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name | ≥ 5.0.0-RC1 < 5.10.8 | 5.1 | — | 2026-08-13 | |
| CVE-2026-72786 | Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset | ≥ 5.0.0-RC1 < 5.10.8 | 7.1 | — | 2026-08-13 | |
| CVE-2026-72785 | Craft CMS before 5.10.6 Authorization Bypass via structures/move-element | ≥ 5.0.0-RC1 < 5.10.6 | 9.3 | — | 2026-08-11 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。