Skip to content

Commit d246f4d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-472v-j2g4-g9h2 GHSA-8wg7-wm29-2rvg GHSA-qx2q-q59v-wf3j
1 parent 857802d commit d246f4d

File tree

3 files changed

+215
-0
lines changed

3 files changed

+215
-0
lines changed

‎advisories/github-reviewed/2026/03/GHSA-472v-j2g4-g9h2/GHSA-472v-j2g4-g9h2.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-472v-j2g4-g9h2",
4+
"modified": "2026-03-16T18:11:49Z",
5+
"published": "2026-03-16T18:11:49Z",
6+
"aliases": [
7+
"CVE-2026-32262"
8+
],
9+
"summary": "Craft CMS has a Path Traversal Vulnerability in AssetsController",
10+
"details": "The `AssetsController->replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.\n\nThis could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.\n\nThis only affects local filesystems.\n\nUsers should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "4.0.0-RC1"
29+
},
30+
{
31+
"fixed": "4.17.5"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 4.17.4"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Packagist",
43+
"name": "craftcms/cms"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "5.0.0-RC1"
51+
},
52+
{
53+
"fixed": "5.9.11"
54+
}
55+
]
56+
}
57+
],
58+
"database_specific": {
59+
"last_known_affected_version_range": "<= 5.9.10"
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-472v-j2g4-g9h2"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://github.com/craftcms/cms/commit/c997efbe4c66c14092714233aeebff15cdbfcf11"
71+
},
72+
{
73+
"type": "PACKAGE",
74+
"url": "https://github.com/craftcms/cms"
75+
}
76+
],
77+
"database_specific": {
78+
"cwe_ids": [
79+
"CWE-22"
80+
],
81+
"severity": "MODERATE",
82+
"github_reviewed": true,
83+
"github_reviewed_at": "2026-03-16T18:11:49Z",
84+
"nvd_published_at": null
85+
}
86+
}

‎advisories/github-reviewed/2026/03/GHSA-8wg7-wm29-2rvg/GHSA-8wg7-wm29-2rvg.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8wg7-wm29-2rvg",
4+
"modified": "2026-03-16T18:11:23Z",
5+
"published": "2026-03-16T18:11:23Z",
6+
"aliases": [
7+
"CVE-2026-32261"
8+
],
9+
"summary": "RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin",
10+
"details": "The Webhooks plugin renders user-supplied template content through Twig’s `renderString()` function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.\n\nThis is possible even if `allowAdminChanges` is set to `false`.\n\nAffected users should update to version 3.2.0 to mitigate the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/webhooks"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "3.0.0"
29+
},
30+
{
31+
"fixed": "3.2.0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/craftcms/webhooks"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-1336"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-16T18:11:23Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-qx2q-q59v-wf3j/GHSA-qx2q-q59v-wf3j.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qx2q-q59v-wf3j",
4+
"modified": "2026-03-16T18:12:32Z",
5+
"published": "2026-03-16T18:12:32Z",
6+
"aliases": [
7+
"CVE-2026-32263"
8+
],
9+
"summary": "Craft CMS vulnerable to behavior injection RCE via EntryTypesController",
10+
"details": "The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `EntryTypesController::actionApplyOverrideSettings()`.\n\nIn `src/controllers/EntryTypesController.php` lines 381-387:\n\n```php\n$settingsStr = $this->request->getBodyParam('settings');\nparse_str($settingsStr, $postedSettings);\n$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');\n$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));\n\nif (!empty($settings)) {\n Craft::configure($entryType, $settings);\n```\n\nThe `$settings` array from `parse_str` is passed directly to `Craft::configure()` without `Component::cleanseConfig()`. This allows injecting Yii2 behavior/event handlers via `as ` or `on ` prefixed keys, the same attack vector as the original advisory.\n\nYou need Craft control panel administrator permissions, and `allowAdminChanges` must be enabled for this to work.\n\nAn attacker can use the same gadget chain from the original advisory to achieve RCE.\n\nUsers should update to Craft 5.9.11 to mitigate the issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "craftcms/cms"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.6.0"
29+
},
30+
{
31+
"fixed": "5.9.11"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 5.9.10"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-7jx7-3846-m7w7"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-qx2q-q59v-wf3j"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/craftcms/cms/commit/d37389dbffafa565143be40a2ab1e1db22a863f7"
53+
},
54+
{
55+
"type": "PACKAGE",
56+
"url": "https://github.com/craftcms/cms"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-470"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-16T18:12:32Z",
66+
"nvd_published_at": null
67+
}
68+
}

0 commit comments

Comments
 (0)