Is craftcms/cms 5.7 vulnerable?
Composer · 12 releases from 5.7.0 to 5.7.11 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
Yes: 73 known advisories
Yes. craftcms/cms 5.7.11, the last 5.7 release, is affected by 73 known security advisories (3 critical, 26 high, 34 medium, 10 low), including CVE-2026-72780, CVE-2026-55791, CVE-2026-28697. 1 more affects earlier 5.7.x releases. Upgrade to 5.10.8 or later to fix all of them.
composer require craftcms/cms:^5.10.8Advisories affecting craftcms/cms 5.7.11
Craft CMS: Passkey login accepts replayed WebAuthn assertions
- Affected
- >=5.0.0-RC1 <5.10.5
- Fixed in
- 5.10.5
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
- Affected
- >=5.0.0-RC1 <5.10.6
- Fixed in
- 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
- Affected
- >=5.5.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
- Affected
- >=4.0.0-RC1 <4.17.7 · >=5.0.0-RC1 <5.9.13
- Fixed in
- 4.17.7, 5.9.13
Craft CMS: Stored XSS via Structure entry title in table view
- Affected
- >=5.0.0-RC1 <5.9.53
- Fixed in
- 5.9.53
Craft CMS: Sensitive File Disclosure / Server-Side File Read
- Affected
- >=4.0.0-RC1 <4.18.0 · >=5.0.0-RC1 <5.10.0
- Fixed in
- 4.18.0, 5.10.0
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- Affected
- >=5.0.0-RC1 <5.9.23 · >=4.0.0-RC1 <4.17.16
- Fixed in
- 4.17.16, 5.9.23
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
- Affected
- >=5.7.0 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- Affected
- >=5.0.0-RC1 <5.9.22 · >=4.0.0-RC1 <4.17.15
- Fixed in
- 4.17.15, 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Affected
- >=5.0.0-RC1 <5.10 · >=4.0.0-RC1 <4.18
- Fixed in
- 4.18, 5.10
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
- Affected
- >=5.0.0-RC1 <5.9.18
- Fixed in
- 5.9.18
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=4.0.0 <4.17.12 · >=5.0.0 <5.9.18
- Fixed in
- 4.17.12, 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- Affected
- >=5.0.0 <5.9.18 · >=4.0.0 <4.17.12
- Fixed in
- 4.17.12, 5.9.18
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
- Affected
- >=5.6.0 <5.9.15
- Fixed in
- 5.9.15
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
- Affected
- >=5.3.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=5.6.0 <5.9.13
- Fixed in
- 5.9.13
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Affected
- >=4.0.0-RC1 <4.17.6 · >=5.0.0-RC1 <5.9.12
- Fixed in
- 4.17.6, 5.9.12
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- Affected
- >=5.6.0 <5.9.11
- Fixed in
- 5.9.11
Craft CMS has a Path Traversal Vulnerability in AssetsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
- Affected
- >=5.0.0-RC1 <5.8.22
- Fixed in
- 5.8.22
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Affected
- >=5.0.0-RC1 <5.9.9 · >=4.0.0-beta.1 <4.17.4
- Fixed in
- 4.17.4, 5.9.9
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
- Affected
- >=5.0.0-RC1 <5.9.9
- Fixed in
- 5.9.9
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
- Affected
- >=4.15.3 <4.17.3 · >=5.7.5 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has a potential information disclosure vulnerability in preview tokens
- Affected
- >=4.0.0-RC1 <4.17.3 · >=5.0.0-RC1 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has unauthenticated activation email trigger with potential user enumeration
- Affected
- >=5.0.0-RC1 <5.9.0-beta.2 · >=4.0.0-RC1 <4.17.0-beta.2
- Fixed in
- 4.17.0-beta.2, 5.9.0-beta.2
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Twig Function Blocklist Bypass
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS: Entries Authorship Spoofing via Mass Assignment
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has IDOR via GraphQL @parseRefs
- Affected
- >=4.0.0-RC1 <4.17.0-beta.1 · >=5.0.0-RC1 <5.9.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type
- Affected
- >=4.5.0-beta.1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS: Cloud Metadata SSRF Protection Bypass via IPv6 Resolution
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit
- Affected
- >=4.5.0-RC1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding
- Affected
- >=5.0.0-RC1 <5.8.23 · >=3.5.0 <4.16.19
- Fixed in
- 4.16.19, 5.8.23
Craft CMS has Stored XSS in Table Field via "HTML" Column Type
- Affected
- >=4.5.0-RC1 <4.16.19 · >=5.0.0-RC1 <5.8.23
- Fixed in
- 4.16.19, 5.8.23
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS: GraphQL Asset Mutation Privilege Escalation
- Affected
- >=5.0.0-RC1 <5.9.0-beta.1 · >=4.0.0-RC1 <4.17.0-beta.1
- Fixed in
- 4.17.0-beta.1, 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
- Affected
- >=5.0.0-RC1 <5.8.22 · >=4.0.0-RC1 <4.16.18
- Fixed in
- 4.16.18, 5.8.22
Craft CMS Vulnerable to Stored XSS in Entry Types Name
- Affected
- >=5.0.0-RC1 <5.8.22
- Fixed in
- 5.8.22
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Unauthenticated Craft CMS users can trigger a database backup
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.0.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=3.5.0 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
- Affected
- >=5.0.0-RC1 <5.8.21 · >=4.0.0-RC1 <4.16.17
- Fixed in
- 4.16.17, 5.8.21
Craft CMS Potential Remote Code Execution via Twig SSTI
- Affected
- >=4.0.0-RC1 <4.16.6 · >=5.0.0-RC1 <5.8.7
- Fixed in
- 4.16.6, 5.8.7
Craft CMS has a theoretical bypass for CVE-2025-23209
- Affected
- >=4.13.8 <4.16.3 · >=5.5.8 <5.8.4
- Fixed in
- 4.16.3, 5.8.4
Fixed within 5.7.x, affecting earlier releases
Craft CMS stores arbitrary content provided by unauthenticated users in session files
- Affected
- >=5.0.0-alpha.1 <5.7.5 · <4.15.3
- Fixed in
- 4.15.3, 5.7.5
Which of your client projects are still on craftcms/cms 5.7?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.