Is craftcms/cms 3.8 vulnerable?
Composer · 18 releases from 3.8.0 to 3.8.17 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
Yes: 11 known advisories
Yes. craftcms/cms 3.8.17, the last 3.8 release, is affected by 11 known security advisories (2 critical, 4 high, 5 medium), including CVE-2025-32432, CVE-2024-56145, CVE-2026-27127. 4 more affect earlier 3.8.x releases. At least one has no fixed release yet.
Advisories affecting craftcms/cms 3.8.17
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.5.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Craft CMS Allows Remote Code Execution
- Affected
- >=3.0.0-RC1 <3.9.15 · >=4.0.0-RC1 <4.14.15 · >=5.0.0-RC1 <5.6.17
- Fixed in
- 3.9.15, 4.14.15, 5.6.17
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
- Affected
- >=5.0.0-RC1 <5.5.2 · >=4.0.0-RC1 <4.13.2 · >=3.0.0 <3.9.14
- Fixed in
- 3.9.14, 4.13.2, 5.5.2
Craft CMS Arbitrary System File Read
- Affected
- >=5.0.0-alpha.1 <5.4.9 · >=3.5.13 <4.12.8
- Fixed in
- 4.12.8, 5.4.9
Craft CMS Feed-Me
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Craft CMS Privilege Escalation
- Affected
- >=4.0.0-RC1 <4.5.11 · >=3.0.0 <3.9.6
- Fixed in
- 3.9.6, 4.5.11
Craft CMS vulnerable to HTML injection
- Affected
- <=4.4.9
- Fixed in
- No fix released
Fixed within 3.8.x, affecting earlier releases
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Affected
- >=4.0.0-RC1 <4.4.15 · >=3.0.0 <3.8.15
- Fixed in
- 3.8.15, 4.4.15
CraftCMS stored XSS in Quick Post widget error message
- Affected
- >=4.0.0-RC1 <4.4.6 · >=3.0.0 <3.8.6
- Fixed in
- 3.8.6, 4.4.6
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter
- Affected
- <=3.8.1
- Fixed in
- No fix released
craftcms/cms vulnerable to cross site scripting in RSS feed widget
- Affected
- >=3.0.0 <3.8.4 · >=4.0.0 <4.4.4
- Fixed in
- 3.8.4, 4.4.4
Which of your client projects are still on craftcms/cms 3.8?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.