Is craftcms/cms 2.8 vulnerable?

Composer · 1 release from 2.8.0 to 2.8.0 · latest craftcms/cms is 5.11.5.1 · checked 2 Nov 2026

Yes: 18 known advisories

Yes. craftcms/cms 2.8.0, the last 2.8 release, is affected by 18 known security advisories (3 critical, 4 high, 10 medium, 1 low), including CVE-2024-37843, CVE-2019-15929, CVE-2021-27903. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting craftcms/cms 2.8.0

  • MediumCVE-2025-35939GHSA-7vrx-9684-xrf28 May 2025

    Craft CMS stores arbitrary content provided by unauthenticated users in session files

    Affected
    >=5.0.0-alpha.1 <5.7.5 · <4.15.3
    Fixed in
    4.15.3, 5.7.5
  • CriticalCVE-2024-37843GHSA-hq4f-mv3q-8wcv25 Jun 2024

    Craft CMS SQL injection vulnerability via the GraphQL API endpoint

    Affected
    <=3.7.31
    Fixed in
    No fix released
  • HighCVE-2023-36260GHSA-6p78-f7h9-683830 Jan 2024

    Craft CMS Feed-Me

    Affected
    <4.6.2
    Fixed in
    4.6.2
  • MediumCVE-2023-33495GHSA-m3v5-gjj9-rg2420 Jun 2023

    Craft CMS vulnerable to HTML injection

    Affected
    <=4.4.9
    Fixed in
    No fix released
  • HighCVE-2023-30130GHSA-fjx5-xm7q-whvj12 May 2023

    CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter

    Affected
    <=3.8.1
    Fixed in
    No fix released
  • MediumCVE-2023-30177GHSA-wv7j-rc2q-9j6725 Apr 2023

    Cross Site Scripting in CraftCMS

    Affected
    <3.7.68
    Fixed in
    3.7.68
  • MediumCVE-2020-19626GHSA-33jj-92px-m4g724 May 2022

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.1.33
    Fixed in
    3.1.33
  • CriticalCVE-2019-15929GHSA-wvr4-w6cw-4px824 May 2022

    Craft CMS possibility of brute force attempts

    Affected
    <3.1.7
    Fixed in
    3.1.7
  • MediumCVE-2019-17496GHSA-f3xr-q258-h7m924 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <3.3.8
    Fixed in
    3.3.8
  • MediumCVE-2019-12823GHSA-w5q4-q7wp-qww624 May 2022

    Craft CMS XSS Vulnerability

    Affected
    <3.1.31
    Fixed in
    3.1.31
  • MediumCVE-2018-20418GHSA-72pf-cvwq-vgqg14 May 2022

    Craft CMS Cross-site Scripting (XSS) Vulnerability

    Affected
    <=3.0.25
    Fixed in
    No fix released
  • HighCVE-2018-20465GHSA-j7fx-v37j-v3w713 May 2022

    Craft CMS Vulnerable to Server-Side Template Injection

    Affected
    <=3.0.34
    Fixed in
    No fix released
  • HighCVE-2022-29933GHSA-5cjr-78cq-3wrg10 May 2022

    Improper account password reset in Craft CMS

    Affected
    <3.7.36
    Fixed in
    3.7.36
  • LowGHSA-wf98-vxv9-jqfv5 Apr 2022

    XSS Injection Vulnerability

    Affected
    <3.7.29
    Fixed in
    3.7.29
  • MediumCVE-2022-28378GHSA-7xj5-fwqr-53784 Apr 2022

    Cross-site Scripting in craftcms/cms

    Affected
    <3.7.29
    Fixed in
    3.7.29
  • MediumCVE-2021-32470GHSA-h2rj-8wgg-mm4318 Mar 2022

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.6.13
    Fixed in
    3.6.13
  • CriticalCVE-2021-27903GHSA-x2j7-6hxm-87p32 Jul 2021

    Craft CMS Remote Code Injection

    Affected
    <3.6.7
    Fixed in
    3.6.7
  • MediumCVE-2021-27902GHSA-3jxh-789f-p7m62 Jul 2021

    Craft CMS Cross-site Scripting Vulnerability

    Affected
    <3.6.0
    Fixed in
    3.6.0

Which of your client projects are still on craftcms/cms 2.8?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other craftcms/cms versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.