Is craftcms/cms 5.9 vulnerable?
Composer · 24 releases from 5.9.0 to 5.9.23 · latest craftcms/cms is 5.11.5.1 · checked 1 Nov 2026
Yes: 15 known advisories
Yes. craftcms/cms 5.9.23, the last 5.9 release, is affected by 15 known security advisories (2 critical, 4 high, 8 medium, 1 low), including CVE-2026-72780, CVE-2026-55791, CVE-2026-72786. 32 more affect earlier 5.9.x releases. Upgrade to 5.10.8 or later to fix all of them.
composer require craftcms/cms:^5.10.8Advisories affecting craftcms/cms 5.9.23
Craft CMS: Passkey login accepts replayed WebAuthn assertions
- Affected
- >=5.0.0-RC1 <5.10.5
- Fixed in
- 5.10.5
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authenticated leak of secret environment variables
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element
- Affected
- >=5.0.0-RC1 <5.10.6
- Fixed in
- 5.10.6
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Incorrect path validation could potentially lead to path traversal
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Stored XSS in the control panel via unescaped draft name
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Arbitrary user password reset leading to administrator account takeover
- Affected
- >=5.0.0-RC1 <5.10.8
- Fixed in
- 5.10.8
Craft CMS: Authenticated RCE through Twig sandbox escape
- Affected
- >=5.0.0-RC1 <5.10.7 · >=4.0.0-RC1 <4.18.3
- Fixed in
- 4.18.3, 5.10.7
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets
- Affected
- >=4.0.0-RC1 <4.18.1 · >=5.0.0-RC1 <5.10.3
- Fixed in
- 4.18.1, 5.10.3
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
- Affected
- >=5.0.0-RC1 <5.10.6 · >=4.0.0-RC1 <4.18.2
- Fixed in
- 4.18.2, 5.10.6
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
- Affected
- >=5.9.0 <5.10.0
- Fixed in
- 5.10.0
Craft CMS: Stored XSS via Structure entry title in table view
- Affected
- >=5.0.0-RC1 <5.9.53
- Fixed in
- 5.9.53
Craft CMS: Sensitive File Disclosure / Server-Side File Read
- Affected
- >=4.0.0-RC1 <4.18.0 · >=5.0.0-RC1 <5.10.0
- Fixed in
- 4.18.0, 5.10.0
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Affected
- >=5.0.0-RC1 <5.10 · >=4.0.0-RC1 <4.18
- Fixed in
- 4.18, 5.10
Fixed within 5.9.x, affecting earlier releases
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
- Affected
- >=5.5.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
- Affected
- >=4.0.0-RC1 <4.17.7 · >=5.0.0-RC1 <5.9.13
- Fixed in
- 4.17.7, 5.9.13
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
- Affected
- >=5.0.0-RC1 <5.9.23 · >=4.0.0-RC1 <4.17.16
- Fixed in
- 4.17.16, 5.9.23
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
- Affected
- >=5.7.0 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
- Affected
- >=5.0.0-RC1 <5.9.22 · >=4.0.0-RC1 <4.17.15
- Fixed in
- 4.17.15, 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
- Affected
- >=5.0.0-RC1 <5.9.21 · >=4.0.0-RC1 <4.17.14
- Fixed in
- 4.17.14, 5.9.21
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
- Affected
- >=5.0.0-RC1 <5.9.21
- Fixed in
- 5.9.21
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
- Affected
- >=5.0.0-RC1 <5.9.18
- Fixed in
- 5.9.18
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=4.0.0 <4.17.12 · >=5.0.0 <5.9.18
- Fixed in
- 4.17.12, 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
- Affected
- >=5.0.0 <5.9.18 · >=4.0.0 <4.17.12
- Fixed in
- 4.17.12, 5.9.18
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
- Affected
- >=5.0.0-RC1 <5.9.15 · >=4.0.0-RC1 <4.17.9
- Fixed in
- 4.17.9, 5.9.15
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
- Affected
- >=5.6.0 <5.9.15
- Fixed in
- 5.9.15
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
- Affected
- >=5.3.0 <5.9.14
- Fixed in
- 5.9.14
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
- Affected
- >=5.0.0-RC1 <5.9.14 · >=4.0.0-RC1 <4.17.8
- Fixed in
- 4.17.8, 5.9.14
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
- Affected
- >=4.0.0-RC1 <4.17.8 · >=5.0.0-RC1 <5.9.14
- Fixed in
- 4.17.8, 5.9.14
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
- Affected
- >=5.6.0 <5.9.13
- Fixed in
- 5.9.13
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
- Affected
- >=5.9.0-beta.1 <5.9.11
- Fixed in
- 5.9.11
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- Affected
- >=4.0.0-RC1 <4.17.6 · >=5.0.0-RC1 <5.9.12
- Fixed in
- 4.17.6, 5.9.12
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- Affected
- >=5.6.0 <5.9.11
- Fixed in
- 5.9.11
Craft CMS has a Path Traversal Vulnerability in AssetsController
- Affected
- >=4.0.0-RC1 <4.17.5 · >=5.0.0-RC1 <5.9.11
- Fixed in
- 4.17.5, 5.9.11
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Affected
- >=5.0.0-RC1 <5.9.9 · >=4.0.0-beta.1 <4.17.4
- Fixed in
- 4.17.4, 5.9.9
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
- Affected
- >=5.0.0-RC1 <5.9.9
- Fixed in
- 5.9.9
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
- Affected
- >=4.15.3 <4.17.3 · >=5.7.5 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Craft CMS has a potential information disclosure vulnerability in preview tokens
- Affected
- >=4.0.0-RC1 <4.17.3 · >=5.0.0-RC1 <5.9.7
- Fixed in
- 4.17.3, 5.9.7
Which of your client projects are still on craftcms/cms 5.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact craftcms/cms version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other craftcms/cms versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.