Is craftcms/cms 3.3 vulnerable?
Composer · 21 releases from 3.3.0 to 3.3.20 · latest craftcms/cms is 5.11.5.1 · checked 2 Nov 2026
Yes: 20 known advisories
Yes. craftcms/cms 3.3.20, the last 3.3 release, is affected by 20 known security advisories (4 critical, 6 high, 8 medium, 2 low), including CVE-2025-32432, CVE-2024-56145, CVE-2024-37843. 1 more affects earlier 3.3.x releases. At least one has no fixed release yet.
Advisories affecting craftcms/cms 3.3.20
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Craft CMS Allows Remote Code Execution
- Affected
- >=3.0.0-RC1 <3.9.15 · >=4.0.0-RC1 <4.14.15 · >=5.0.0-RC1 <5.6.17
- Fixed in
- 3.9.15, 4.14.15, 5.6.17
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
- Affected
- >=5.0.0-RC1 <5.5.2 · >=4.0.0-RC1 <4.13.2 · >=3.0.0 <3.9.14
- Fixed in
- 3.9.14, 4.13.2, 5.5.2
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
- Affected
- <=3.7.31
- Fixed in
- No fix released
Craft CMS Feed-Me
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Craft CMS Privilege Escalation
- Affected
- >=4.0.0-RC1 <4.5.11 · >=3.0.0 <3.9.6
- Fixed in
- 3.9.6, 4.5.11
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Affected
- >=4.0.0-RC1 <4.4.15 · >=3.0.0 <3.8.15
- Fixed in
- 3.8.15, 4.4.15
Craft CMS vulnerable to HTML injection
- Affected
- <=4.4.9
- Fixed in
- No fix released
CraftCMS stored XSS in Quick Post widget error message
- Affected
- >=4.0.0-RC1 <4.4.6 · >=3.0.0 <3.8.6
- Fixed in
- 3.8.6, 4.4.6
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
- Affected
- <=3.8.1
- Fixed in
- No fix released
craftcms/cms vulnerable to cross site scripting in RSS feed widget
- Affected
- >=3.0.0 <3.8.4 · >=4.0.0 <4.4.4
- Fixed in
- 3.8.4, 4.4.4
Cross Site Scripting in CraftCMS
- Affected
- <3.7.68
- Fixed in
- 3.7.68
Craft CMS discloses password hashes
- Affected
- >=3.0.0 <3.7.33
- Fixed in
- 3.7.33
Improper account password reset in Craft CMS
- Affected
- <3.7.36
- Fixed in
- 3.7.36
XSS Injection Vulnerability
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Cross-site Scripting in craftcms/cms
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.13
- Fixed in
- 3.6.13
Craft CMS Remote Code Injection
- Affected
- <3.6.7
- Fixed in
- 3.6.7
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.0
- Fixed in
- 3.6.0
Fixed within 3.3.x, affecting earlier releases
Craft CMS XSS Vulnerability
- Affected
- <3.3.8
- Fixed in
- 3.3.8
Which of your client projects are still on craftcms/cms 3.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.