Is craftcms/cms 4.3 vulnerable?
Composer · 12 releases from 4.3.0 to 4.3.11 · latest craftcms/cms is 5.11.5.1 · checked 2 Nov 2026
Yes: 72 known advisories
Yes. craftcms/cms 4.3.11, the last 4.3 release, is affected by 72 known security advisories (5 critical, 26 high, 33 medium, 8 low), including CVE-2026-55791, CVE-2026-28697, CVE-2025-32432. 1 more affects earlier 4.3.x releases. At least one has no fixed release yet.
Advisories affecting craftcms/cms 4.3.11
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
- Affected
- >=4.0.0-RC1 <4.17.7 · >=5.0.0-RC1 <5.9.13
- Fixed in
- 4.17.7, 5.9.13
Craft CMS: Sensitive File Disclosure / Server-Side File Read
- Affected
- >=4.0.0-RC1 <4.18.0 · >=5.0.0-RC1 <5.10.0
- Fixed in
- 4.18.0, 5.10.0
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- Affected
- >=5.0.0-RC1 <5.9.23 · >=4.0.0-RC1 <4.17.16
- Fixed in
- 4.17.16, 5.9.23
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- Affected
- >=5.0.0-RC1 <5.9.22 · >=4.0.0-RC1 <4.17.15
- Fixed in
- 4.17.15, 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Affected
- >=5.0.0-RC1 <5.10 · >=4.0.0-RC1 <4.18
- Fixed in
- 4.18, 5.10
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=4.0.0 <4.17.12 · >=5.0.0 <5.9.18
- Fixed in
- 4.17.12, 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- Affected
- >=5.0.0 <5.9.18 · >=4.0.0 <4.17.12
- Fixed in
- 4.17.12, 5.9.18
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Affected
- >=4.0.0-RC1 <4.17.6 · >=5.0.0-RC1 <5.9.12
- Fixed in
- 4.17.6, 5.9.12
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS has a Path Traversal Vulnerability in AssetsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Affected
- >=5.0.0-RC1 <5.9.9 · >=4.0.0-beta.1 <4.17.4
- Fixed in
- 4.17.4, 5.9.9
Craft CMS has a potential information disclosure vulnerability in preview tokens
- Affected
- >=4.0.0-RC1 <4.17.3 · >=5.0.0-RC1 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has unauthenticated activation email trigger with potential user enumeration
- Affected
- >=5.0.0-RC1 <5.9.0-beta.2 · >=4.0.0-RC1 <4.17.0-beta.2
- Fixed in
- 4.17.0-beta.2, 5.9.0-beta.2
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Twig Function Blocklist Bypass
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS: Entries Authorship Spoofing via Mass Assignment
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has IDOR via GraphQL @parseRefs
- Affected
- >=4.0.0-RC1 <4.17.0-beta.1 · >=5.0.0-RC1 <5.9.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
- Affected
- >=5.8.7 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS: GraphQL Asset Mutation Privilege Escalation
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.5.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS Potential Remote Code Execution via Twig SSTI
- Affected
- >=4.0.0-RC1 <4.16.6 · >=5.0.0-RC1 <5.8.7
- Fixed in
- 4.16.6, 5.8.7
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
- Affected
- >=4.0.0-RC1 <4.14.13 · >=5.0.0-RC1 <5.6.15
- Fixed in
- 4.14.13, 5.6.15
Craft CMS Allows Remote Code Execution
- Affected
- >=3.0.0-RC1 <3.9.15 · >=4.0.0-RC1 <4.14.15 · >=5.0.0-RC1 <5.6.17
- Fixed in
- 3.9.15, 4.14.15, 5.6.17
Craft CMS has a potential RCE with a compromised security key
- Affected
- >=5.0.0-RC1 <5.5.8 · >=4.0.0-RC1 <4.13.8
- Fixed in
- 4.13.8, 5.5.8
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
- Affected
- >=5.0.0-RC1 <5.5.2 · >=4.0.0-RC1 <4.13.2 · >=3.0.0 <3.9.14
- Fixed in
- 3.9.14, 4.13.2, 5.5.2
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
- Affected
- >=4.0.0-RC1 <4.12.2 · >=5.0.0-RC1 <5.4.3
- Fixed in
- 4.12.2, 5.4.3
Craft CMS Arbitrary System File Read
- Affected
- >=5.0.0-alpha.1 <5.4.9 · >=3.5.13 <4.12.8
- Fixed in
- 4.12.8, 5.4.9
Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
- Affected
- >=5.0.0-RC1 <5.4.6 · >=4.0.0-RC1 <4.12.5
- Fixed in
- 4.12.5, 5.4.6
Craft CMS Feed-Me
- Affected
- <4.6.2
- Fixed in
- 4.6.2
Craft CMS Privilege Escalation
- Affected
- >=4.0.0-RC1 <4.5.11 · >=3.0.0 <3.9.6
- Fixed in
- 3.9.6, 4.5.11
Craft CMS Remote Code Execution vulnerability
- Affected
- >=4.0.0-RC1 <4.4.15
- Fixed in
- 4.4.15
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
- Affected
- >=4.0.0-RC1 <4.4.15 · >=3.0.0 <3.8.15
- Fixed in
- 3.8.15, 4.4.15
Craft CMS vulnerable to HTML injection
- Affected
- <=4.4.9
- Fixed in
- No fix released
Stored cross site scripting in Craft CMS
- Affected
- >=4.0.0-RC1 <4.4.12
- Fixed in
- 4.4.12
Craft CMS stored XSS in indexedVolumes
- Affected
- >=4.0.0-RC1 <4.4.6
- Fixed in
- 4.4.6
Craft CMS stored XSS in review volume
- Affected
- >=4.0.0-RC1 <4.4.7
- Fixed in
- 4.4.7
Craft CMS XSS in RSS widget feed
- Affected
- >=4.3.0 <4.4.6
- Fixed in
- 4.4.6
CraftCMS stored XSS in Quick Post widget error message
- Affected
- >=4.0.0-RC1 <4.4.6 · >=3.0.0 <3.8.6
- Fixed in
- 3.8.6, 4.4.6
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
- Affected
- >=4.0.0 <4.4.6
- Fixed in
- 4.4.6
craftcms/cms vulnerable to cross site scripting in RSS feed widget
- Affected
- >=3.0.0 <3.8.4 · >=4.0.0 <4.4.4
- Fixed in
- 3.8.4, 4.4.4
Fixed within 4.3.x, affecting earlier releases
Craft CMS Stored Cross-site Scripting Injection Vulnerability
- Affected
- >=4.0.0-RC1 <4.3.7 · >=3.7.24 <3.7.64
- Fixed in
- 3.7.64, 4.3.7
Which of your client projects are still on craftcms/cms 4.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.