craftcms cms
Published Atomicorp research notes for CVEs affecting craftcms cms where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-105985 | Authenticated RCE via render-components Entry Type overrides | 8.7 (v4.0) | High | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-115935 | Control panel only API response emulation replaces "securityKey" and reaches server RCE | 8.7 (v4.0) | High | 390719 |
| CVE-2026-78416 | Authenticated RCE via condition.config JSON cleanse bypass | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-79987 | Low-privilege RCE through element-search eager loading | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-86732 | Craft CMS before 5.10.12 Remote Code Execution via element-index | 8.7 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-44011 | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-56382 | Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController | 8.6 (v4.0) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | 7.1 (v4.0) | High | 340007 , 344360 , 347009 , 390709 , 399069 |
| CVE-2026-55793 | Craft CMS: Stored XSS via Structure entry title in table view | 5.9 (v4.0) | Medium | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-41130 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | 5.5 (v4.0) | Medium | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56381 | Craft CMS - Stored XSS via User Group Name in User Permissions Page | 4.6 (v4.0) | Medium | 333140 , 333141 , 340095 , 340148 |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | 4.6 (v4.0) | Medium | 333140 , 333141 , 340095 , 340148 , 346755 , 350148 |