Is craftcms/cms 2.6 vulnerable?

Composer · 103 releases from 2.6.2771 to 2.6.3019 · latest craftcms/cms is 5.11.5.1 · checked 2 Nov 2026

Yes: 18 known advisories

Yes. craftcms/cms 2.6.3019, the last 2.6 release, is affected by 18 known security advisories (3 critical, 4 high, 10 medium, 1 low), including CVE-2024-37843, CVE-2019-15929, CVE-2021-27903. 6 more affect earlier 2.6.x releases. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting craftcms/cms 2.6.3019

  • MediumCVE-2025-35939GHSA-7vrx-9684-xrf28 May 2025

    Craft CMS stores arbitrary content provided by unauthenticated users in session files

    Affected
    >=5.0.0-alpha.1 <5.7.5 · <4.15.3
    Fixed in
    4.15.3, 5.7.5
  • CriticalCVE-2024-37843GHSA-hq4f-mv3q-8wcv25 Jun 2024

    Craft CMS SQL injection vulnerability via the GraphQL API endpoint

    Affected
    <=3.7.31
    Fixed in
    No fix released
  • HighCVE-2023-36260GHSA-6p78-f7h9-683830 Jan 2024

    Craft CMS Feed-Me

    Affected
    <4.6.2
    Fixed in
    4.6.2
  • MediumCVE-2023-33495GHSA-m3v5-gjj9-rg2420 Jun 2023

    Craft CMS vulnerable to HTML injection

    Affected
    <=4.4.9
    Fixed in
    No fix released
  • HighCVE-2023-30130GHSA-fjx5-xm7q-whvj12 May 2023

    CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

    Affected
    <=3.8.1
    Fixed in
    No fix released
  • MediumCVE-2023-30177GHSA-wv7j-rc2q-9j6725 Apr 2023

    Cross Site Scripting in CraftCMS

    Affected
    <3.7.68
    Fixed in
    3.7.68
  • MediumCVE-2020-19626GHSA-33jj-92px-m4g724 May 2022

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.1.33
    Fixed in
    3.1.33
  • CriticalCVE-2019-15929GHSA-wvr4-w6cw-4px824 May 2022

    Craft CMS possibility of brute force attempts

    Affected
    <3.1.7
    Fixed in
    3.1.7
  • MediumCVE-2019-17496GHSA-f3xr-q258-h7m924 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <3.3.8
    Fixed in
    3.3.8
  • MediumCVE-2019-12823GHSA-w5q4-q7wp-qww624 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <3.1.31
    Fixed in
    3.1.31
  • MediumCVE-2018-20418GHSA-72pf-cvwq-vgqg14 May 2022

    Craft CMS Cross-site Scripting (XSS) Vulnerability

    Affected
    <=3.0.25
    Fixed in
    No fix released
  • HighCVE-2018-20465GHSA-j7fx-v37j-v3w713 May 2022

    Craft CMS Vulnerable to Server-Side Template Injection

    Affected
    <=3.0.34
    Fixed in
    No fix released
  • HighCVE-2022-29933GHSA-5cjr-78cq-3wrg10 May 2022

    Improper account password reset in Craft CMS

    Affected
    <3.7.36
    Fixed in
    3.7.36
  • LowGHSA-wf98-vxv9-jqfv5 Apr 2022

    XSS Injection Vulnerability

    Affected
    <3.7.29
    Fixed in
    3.7.29
  • MediumCVE-2022-28378GHSA-7xj5-fwqr-53784 Apr 2022

    Cross-site Scripting in craftcms/cms

    Affected
    <3.7.29
    Fixed in
    3.7.29
  • MediumCVE-2021-32470GHSA-h2rj-8wgg-mm4318 Mar 2022

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.6.13
    Fixed in
    3.6.13
  • CriticalCVE-2021-27903GHSA-x2j7-6hxm-87p32 Jul 2021

    Craft CMS Remote Code Injection

    Affected
    <3.6.7
    Fixed in
    3.6.7
  • MediumCVE-2021-27902GHSA-3jxh-789f-p7m62 Jul 2021

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.6.0
    Fixed in
    3.6.0

Fixed within 2.6.x, affecting earlier releases

  • MediumCVE-2017-8052GHSA-xv5f-2997-qhrq17 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <2.6.2974
    Fixed in
    2.6.2974
  • MediumCVE-2017-8384GHSA-9mcw-mwxv-grwj17 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <2.6.2976
    Fixed in
    2.6.2976
  • MediumCVE-2017-8385GHSA-j27g-r58q-624w17 May 2022

    Craft CMS subject to URL forgery

    Affected
    <2.6.2976
    Fixed in
    2.6.2976
  • MediumCVE-2017-9516GHSA-6pvw-hh48-jx7p17 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <2.6.2982
    Fixed in
    2.6.2982
  • MediumCVE-2017-8383GHSA-7qq6-fgpw-xw4513 May 2022

    Craft CMS Unauthorized View

    Affected
    <2.6.2976
    Fixed in
    2.6.2976
  • HighCVE-2018-3814GHSA-r342-vjc4-wrmj13 May 2022

    Craft CMS PHP Code Injection Vulnerability

    Affected
    <=2.6.3000
    Fixed in
    No fix released

Which of your client projects are still on craftcms/cms 2.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other craftcms/cms versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.