VulertSecurity VulertSecurity

Vulnerability Database · Packagist · craftcms/cms · Version

craftcms/cms 5.9.9

5.9.9 is affected by 54 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 4 High 23 Medium 23 Low 4 Unrated 0

All craftcms/cms versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

craftcms/cms 5.9.9 vulnerabilities

54 vulnerabilities cover craftcms/cms 5.9.9. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
Craft CMS SQL Injection Vulnerability via GraphQL API Endpoint 9.8 critical No fix published 25 Jun 2024
CVE-2026-55791: Craft CMS Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning 9.2 critical 5.10 19 Jun 2026
Replayable Passkey Login Vulnerability in Craft CMS: Craft CMS 5.10.3 and Below 9.1 critical 5.10.5 07 Aug 2026
Remote Code Execution Vulnerability in Craft CMS: Authenticated RCE through Twig Sandbox Escape 8.8 high No fix published 11 Aug 2026
Authenticated Remote Code Execution Vulnerability in Craft CMS 8.8 high No fix published 11 Aug 2026
CVE-2023-30130: CraftCMS Remote Code Execution 8.8 high No fix published 12 May 2023
Craft CMS PHP Code Injection Vulnerability in craftcms/cms 8.8 high No fix published 13 May 2022
Authenticated RCE Vulnerability in Craft CMS: Twig Sandbox Escape 8.7 high 5.10.7 06 Aug 2026
Authenticated RCE Vulnerability in Craft CMS: Bypass of JSON Cleanse in Condition Handling 8.7 high 5.10.6 06 Aug 2026
CVE-2026-55794: Craft CMS Authenticated Remote Code Execution via Referrer Redirect 8.7 high 5.10.0 06 Jul 2026
CVE-2026-33157: Craft CMS Authenticated Remote Code Execution Vulnerability 8.7 high 5.9.13 24 Mar 2026
CVE-2026-56382: Craft CMS RCE via Missing CleanseConfig in FieldsController 8.6 high 5.9.14 09 Jul 2026
CVE-2026-32263: Craft CMS EntryTypesController RCE Vulnerability 8.6 high 5.9.11 16 Mar 2026
CVE-2026-50279: Craft CMS Authorship Spoofing via Authorization Gap in EntriesController 7.6 high 5.9.21 02 Jul 2026
CVE-2026-55790: Craft CMS DOM XSS Vulnerability via GitHub Issue Title 7.4 high 5.9.23 06 Jul 2026
Remote Code Execution Vulnerability in Craft CMS: Missing Config Cleansing in FieldsController 7.2 high No fix published 21 Jun 2026
Craft CMS Vulnerable to Server-Side Template Injection 7.2 high No fix published 13 May 2022
CVE-2026-50282: Craft CMS Unauthorized Deletion of Destination Folders During Forced Moves 7.1 high 5.9.21 02 Jul 2026
CVE-2026-50281: Craft CMS Mass Assignment Vulnerability in Bulk Duplicate Functionality 7.1 high 5.9.21 02 Jul 2026
CVE-2026-50284: Craft CMS AssetsController Vulnerability Allows Unauthorized Deletion of Peer Assets 7.1 high 5.9.22 02 Jul 2026
CVE-2026-44012: Craft CMS Information Disclosure via Missing Volume Permission Check 7.1 high 5.9.18 06 May 2026
CVE-2026-44010: Craft CMS GraphQL Address Resolver Lacks Authorization, Leading to PII Disclosure 7.1 high 5.9.18 06 May 2026
Arbitrary File Read Vulnerability in Craft CMS (Versions 4.x and 5.x) 6.9 medium 5.10.6 06 Aug 2026
CVE-2026-33159: Craft CMS Unauthenticated Users Can Perform Restricted Project Config Sync Operations 6.9 medium 5.9.14 24 Mar 2026
Craft CMS Vulnerability: Authenticated Leak of Secret Environment Variables 6.5 high No fix published 11 Aug 2026
Authenticated Path Traversal Vulnerability in Craft CMS (4.0.0-RC1 to 4.17.6) 6.5 high No fix published 21 Jun 2026
Path Traversal Vulnerability in Craft CMS: Incorrect Path Validation 6.2 medium No fix published 11 Aug 2026
CVE-2023-33495: Craft CMS HTML Injection Vulnerability 6.1 medium No fix published 20 Jun 2023
CVE-2026-50280: Craft CMS Authorization Bypass in Entries Move to Section 6.0 medium 5.9.21 02 Jul 2026
CVE-2026-55793: Craft CMS Stored XSS via Structure Entry Title in Table View 5.9 medium 5.9.53 06 Jul 2026
Host Header Injection Vulnerability in Craft CMS Leading to SSRF 5.5 medium 5.9.15 14 Apr 2026
Server-Side Request Forgery (SSRF) Vulnerability in Craft CMS - Asset Uploads Mutations 5.5 medium 5.9.15 14 Apr 2026
Authorization Bypass in Craft CMS: Modify Category Structure with View-Only Permissions 5.3 medium 5.10.6 06 Aug 2026
CVE-2026-50283: Craft CMS Unauthorized Deletion of Source Assets During File Replacement 5.3 medium 5.9.21 02 Jul 2026
Craft CMS User Group Removal Vulnerability - Missing Authorization Check 5.3 medium 5.9.15 14 Apr 2026
CVE-2026-33051: Craft CMS Stored XSS Vulnerability in Revision Context Menu 5.3 medium 5.9.11 18 Mar 2026
Authenticated Environment Variable Leak in Craft CMS: CVE-2026-31857 5.1 medium 5.10.6 06 Aug 2026
Stored XSS Vulnerability in Craft CMS Control Panel via Unescaped Draft Name 5.1 medium 5.10.8 06 Aug 2026
CVE-2026-33162: Craft CMS Authorization Bypass Allows Unauthorized Entry Movement 4.9 medium 5.9.14 24 Mar 2026
Stored XSS Vulnerability in Craft CMS 4.x and 5.x 4.8 medium No fix published 21 Jun 2026
Stored XSS Vulnerability in Craft CMS Table Field - GHSA-5w9j-w5p8-r4p7 4.8 medium No fix published 21 Jun 2026
Stored XSS Vulnerability in Craft CMS (5.0.0-RC1 to 5.8.21) via User Group Name 4.8 medium No fix published 21 Jun 2026
Craft CMS Cross-site Scripting (XSS) Vulnerability in craftcms/cms 4.8 medium No fix published 14 May 2022
Arbitrary File Read Vulnerability in Craft CMS: A Security Risk for Administrators 4.5 high No fix published 11 Aug 2026
Authorization Bypass in Craft CMS: Critical Vulnerability in Category Structure Modification 4.3 critical No fix published 11 Aug 2026
Authorization Bypass Vulnerability in Craft CMS: Non-Admin Control Panel Users Can Reorder Global Sets 4.3 medium No fix published 06 Jul 2026
Unauthorized Access in Craft CMS: User Registration Metrics Vulnerability 4.3 medium No fix published 06 Jul 2026
Craft CMS Authenticated Asset Preview Vulnerability: Unauthorized Access to Private Asset Links 4.3 medium No fix published 21 Jun 2026
Craft CMS Asset Preview Bypass Vulnerability: Unauthorized Access to Private Metadata 4.3 medium No fix published 21 Jun 2026
CVE-2026-33160: Craft CMS Exposes Private Assets via Unauthenticated Transform URL Generation 2.7 low 5.9.14 24 Mar 2026
Path Traversal Vulnerability in Craft CMS: EnsurePathIsContained Function 2.1 low 5.10.6 06 Aug 2026
Unauthorized Asset Preview Access in Craft CMS: Bypass Vulnerability 1.3 low 5.9.14 26 Mar 2026
CVE-2026-33161: Craft CMS Asset Editor Metadata Exposure Vulnerability 1.3 low 5.9.14 24 Mar 2026
Craft CMS Arbitrary Password Reset Vulnerability in craftcms/cms N/A high 5.10.8 06 Aug 2026

Looking for another version, or everything Vulert holds for craftcms/cms?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About craftcms/cms 5.9.9

Is craftcms/cms 5.9.9 vulnerable?

Yes. 54 vulnerabilities in the Vulert database cover craftcms/cms 5.9.9: 4 critical, 23 high, 23 medium and 4 low. Each entry above names the fixed version to move to.

How do I monitor craftcms/cms for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the craftcms/cms version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.