https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33162.htmlhttps://patchthecve.com/cve/CVE-2026-33162.htmlWed, 17 Jun 2026 10:37:03 +0000MEDIUM 6.5: Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:{sectionUid} permission for either sohttps://patchthecve.com/cve/CVE-2026-33161.htmlhttps://patchthecve.com/cve/CVE-2026-33161.htmlWed, 17 Jun 2026 10:37:03 +0000MEDIUM 4.3: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response datahttps://patchthecve.com/cve/CVE-2026-33160.htmlhttps://patchthecve.com/cve/CVE-2026-33160.htmlWed, 17 Jun 2026 10:37:03 +0000MEDIUM 5.3: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. Thhttps://patchthecve.com/cve/CVE-2026-33159.htmlhttps://patchthecve.com/cve/CVE-2026-33159.htmlWed, 17 Jun 2026 10:37:03 +0000MEDIUM 6.5: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions (regenerate-yaml, apply-yaml-changhttps://patchthecve.com/cve/CVE-2026-33158.htmlhttps://patchthecve.com/cve/CVE-2026-33158.htmlWed, 17 Jun 2026 10:37:02 +0000MEDIUM 6.5: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized https://patchthecve.com/cve/CVE-2026-33157.htmlhttps://patchthecve.com/cve/CVE-2026-33157.htmlWed, 17 Jun 2026 10:37:02 +0000HIGH 7.2: Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.13, a Remote Code Execution (RCE) vulnerability exists in Craft CMS, it can be exploited by any authenticated user with control panel access. This is a bypass of a previous fix. The existing patches add cleanseChttps://patchthecve.com/cve/CVE-2026-33051.htmlhttps://patchthecve.com/cve/CVE-2026-33051.htmlWed, 17 Jun 2026 10:36:51 +0000MEDIUM 5.4: Craft CMS is a content management system (CMS). In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw() combined with Craft::t() string interpolation. A low-privileged control panel ushttps://patchthecve.com/cve/CVE-2026-32267.htmlhttps://patchthecve.com/cve/CVE-2026-32267.htmlWed, 17 Jun 2026 10:35:27 +0000CRITICAL 9.8: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->acthttps://patchthecve.com/cve/CVE-2026-32264.htmlhttps://patchthecve.com/cve/CVE-2026-32264.htmlWed, 17 Jun 2026 10:35:27 +0000HIGH 7.2: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allhttps://patchthecve.com/cve/CVE-2026-32263.htmlhttps://patchthecve.com/cve/CVE-2026-32263.htmlWed, 17 Jun 2026 10:35:26 +0000HIGH 7.2: Craft CMS is a content management system (CMS). From version 5.6.0 to before version 5.9.11, in src/controllers/EntryTypesController.php, the $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlershttps://patchthecve.com/cve/CVE-2026-32262.htmlhttps://patchthecve.com/cve/CVE-2026-32262.htmlWed, 17 Jun 2026 10:35:26 +0000MEDIUM 4.3: Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, the AssetsController->replaceFile() method has a targetFilename body parameter that is used unsanitized in a deleteFile() call before Assets::prepareAshttps://patchthecve.com/cve/CVE-2026-29113.htmlhttps://patchthecve.com/cve/CVE-2026-29113.htmlWed, 02 Sep 2026 14:17:11 +0000MEDIUM 4.3: Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an atthttps://patchthecve.com/cve/CVE-2026-29069.htmlhttps://patchthecve.com/cve/CVE-2026-29069.htmlWed, 17 Jun 2026 10:29:32 +0000MEDIUM 5.3: Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pendihttps://patchthecve.com/cve/CVE-2026-28784.htmlhttps://patchthecve.com/cve/CVE-2026-28784.htmlWed, 17 Jun 2026 10:29:02 +0000HIGH 7.2: Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to https://patchthecve.com/cve/CVE-2026-28783.htmlhttps://patchthecve.com/cve/CVE-2026-28783.htmlWed, 17 Jun 2026 10:29:02 +0000CRITICAL 9.1: Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP functions from being called via Twig non-Closure arrow functions. In order to be able to successfully execute this attack, you need to either havhttps://patchthecve.com/cve/CVE-2026-28782.htmlhttps://patchthecve.com/cve/CVE-2026-28782.htmlWed, 17 Jun 2026 10:29:02 +0000MEDIUM 4.3: Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is resthttps://patchthecve.com/cve/CVE-2026-28781.htmlhttps://patchthecve.com/cve/CVE-2026-28781.htmlWed, 17 Jun 2026 10:29:01 +0000MEDIUM 6.5: Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend prhttps://patchthecve.com/cve/CVE-2026-28697.htmlhttps://patchthecve.com/cve/CVE-2026-28697.htmlWed, 17 Jun 2026 10:28:55 +0000CRITICAL 9.1: Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.writhttps://patchthecve.com/cve/CVE-2026-28696.htmlhttps://patchthecve.com/cve/CVE-2026-28696.htmlWed, 17 Jun 2026 10:28:55 +0000HIGH 7.5: Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access senshttps://patchthecve.com/cve/CVE-2026-28695.htmlhttps://patchthecve.com/cve/CVE-2026-28695.htmlWed, 17 Jun 2026 10:28:55 +0000HIGH 7.2: Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation o