Is craftcms/cms 3.5 vulnerable?
Composer · 20 releases from 3.5.0 to 3.5.19 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
Yes: 25 known advisories
Yes. craftcms/cms 3.5.19, the last 3.5 release, is affected by 25 known security advisories (4 critical, 9 high, 10 medium, 2 low), including CVE-2025-32432, CVE-2024-56145, CVE-2024-37843. At least one has no fixed release yet.
Advisories affecting craftcms/cms 3.5.19
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.5.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Craft CMS Allows Remote Code Execution
- Affected
- >=3.0.0-RC1 <3.9.15 · >=4.0.0-RC1 <4.14.15 · >=5.0.0-RC1 <5.6.17
- Fixed in
- 3.9.15, 4.14.15, 5.6.17
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
- Affected
- >=5.0.0-RC1 <5.5.2 · >=4.0.0-RC1 <4.13.2 · >=3.0.0 <3.9.14
- Fixed in
- 3.9.14, 4.13.2, 5.5.2
Craft CMS Arbitrary System File Read
- Affected
- >=5.0.0-alpha.1 <5.4.9 · >=3.5.13 <4.12.8
- Fixed in
- 4.12.8, 5.4.9
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
- Affected
- <=3.7.31
- Fixed in
- No fix released
Craft CMS Feed-Me
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Craft CMS Privilege Escalation
- Affected
- >=4.0.0-RC1 <4.5.11 · >=3.0.0 <3.9.6
- Fixed in
- 3.9.6, 4.5.11
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Affected
- >=4.0.0-RC1 <4.4.15 · >=3.0.0 <3.8.15
- Fixed in
- 3.8.15, 4.4.15
Craft CMS vulnerable to HTML injection
- Affected
- <=4.4.9
- Fixed in
- No fix released
CraftCMS stored XSS in Quick Post widget error message
- Affected
- >=4.0.0-RC1 <4.4.6 · >=3.0.0 <3.8.6
- Fixed in
- 3.8.6, 4.4.6
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
- Affected
- <=3.8.1
- Fixed in
- No fix released
craftcms/cms vulnerable to cross site scripting in RSS feed widget
- Affected
- >=3.0.0 <3.8.4 · >=4.0.0 <4.4.4
- Fixed in
- 3.8.4, 4.4.4
Cross Site Scripting in CraftCMS
- Affected
- <3.7.68
- Fixed in
- 3.7.68
Craft CMS discloses password hashes
- Affected
- >=3.0.0 <3.7.33
- Fixed in
- 3.7.33
Improper account password reset in Craft CMS
- Affected
- <3.7.36
- Fixed in
- 3.7.36
XSS Injection Vulnerability
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Cross-site Scripting in craftcms/cms
- Affected
- <3.7.29
- Fixed in
- 3.7.29
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.13
- Fixed in
- 3.6.13
CSV Injection Vulnerability
- Affected
- >=3.4.0 <3.7.14
- Fixed in
- 3.7.14
Craft CMS Remote Code Injection
- Affected
- <3.6.7
- Fixed in
- 3.6.7
Craft CMS Cross-site Scripting Vulnerability
- Affected
- <3.6.0
- Fixed in
- 3.6.0
Which of your client projects are still on craftcms/cms 3.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.