Is craftcms/cms 4.17 vulnerable?
Composer · 17 releases from 4.17.0 to 4.17.16 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
Yes: 9 known advisories
Yes. craftcms/cms 4.17.16, the last 4.17 release, is affected by 9 known security advisories (1 critical, 2 high, 5 medium, 1 low), including CVE-2026-55791, CVE-2026-72781, CVE-2026-72778. 21 more affect earlier 4.17.x releases. Upgrade to 4.18.3 or later to fix all of them.
composer require craftcms/cms:^4.18.3Advisories affecting craftcms/cms 4.17.16
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Sensitive File Disclosure / Server-Side File Read
- Affected
- >=4.0.0-RC1 <4.18.0 · >=5.0.0-RC1 <5.10.0
- Fixed in
- 4.18.0, 5.10.0
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Affected
- >=5.0.0-RC1 <5.10 · >=4.0.0-RC1 <4.18
- Fixed in
- 4.18, 5.10
Fixed within 4.17.x, affecting earlier releases
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
- Affected
- >=4.0.0-RC1 <4.17.7 · >=5.0.0-RC1 <5.9.13
- Fixed in
- 4.17.7, 5.9.13
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- Affected
- >=5.0.0-RC1 <5.9.23 · >=4.0.0-RC1 <4.17.16
- Fixed in
- 4.17.16, 5.9.23
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- Affected
- >=5.0.0-RC1 <5.9.22 · >=4.0.0-RC1 <4.17.15
- Fixed in
- 4.17.15, 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=4.0.0 <4.17.12 · >=5.0.0 <5.9.18
- Fixed in
- 4.17.12, 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- Affected
- >=5.0.0 <5.9.18 · >=4.0.0 <4.17.12
- Fixed in
- 4.17.12, 5.9.18
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Affected
- >=4.0.0-RC1 <4.17.6 · >=5.0.0-RC1 <5.9.12
- Fixed in
- 4.17.6, 5.9.12
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS has a Path Traversal Vulnerability in AssetsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Affected
- >=5.0.0-RC1 <5.9.9 · >=4.0.0-beta.1 <4.17.4
- Fixed in
- 4.17.4, 5.9.9
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
- Affected
- >=4.15.3 <4.17.3 · >=5.7.5 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has a potential information disclosure vulnerability in preview tokens
- Affected
- >=4.0.0-RC1 <4.17.3 · >=5.0.0-RC1 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Which of your client projects are still on craftcms/cms 4.17?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.