{ "@id": "urn:uuid:d0bf9e9b-e51c-40dd-85da-f6b09ca46f38", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-16T12:41:00.266160+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2022-37251 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-37251" }, "impact_statement": "not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS version 4.2.0.1. The target is running version 4.18.9, which already contains all the XSS fixes from the upstream vendor. The vulnerability pattern (unescaped HTML rendering of user-controlled strings) is not present in the target because HTML encoding (`Html::encode()`, Twig `|e` filter, `Craft.escapeHtml()`) has been applied to all affected f..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2024-41800 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-41800" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2024-41800. The vulnerability concerns TOTP token reuse in Craft CMS 5's two-factor authentication system. TOTP authentication functionality was introduced in Craft CMS 5 and does not exist in Craft 4. The target repository contains no TOTP implementation code, no Google2FA dependency, no authenticator database tables, and no TOTP verification methods. Th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52291 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52291" }, "impact_statement": "CVE-2024-52291 is NOT present in CraftCMS 4.18.9. The vulnerability involved bypassing local filesystem validation using double file:// schemes (e.g., file://file:////), but the upstream fix was already included in version 4.18.9 when TuxCare onboarded it. The vulnerable code pattern (StringHelper::removeLeft) was replaced with a secure regex pattern that removes all consecutive file:// prefixes." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52292 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52292" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2024-52292. The vulnerability pattern\u2014unrestricted absolute file path reading via the dataUrl() function\u2014is not present. The fix (path containment validation at src/helpers/Html.php:995-999) was included in upstream Craft CMS 4.18.9 before TuxCare onboarded the version on 2026-09-24. The snapshot commit imported the already-fixed codebase, and no subsequent modifications were made to the dataUrl() function on this branch." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2024-52293 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-52293" }, "impact_statement": "CVE-2024-52293 is NOT present in the target. The vulnerability (missing normalizePath in FileHelper::absolutePath) was fixed by upstream Craft CMS in version 4.12.2 (commit 123e48a696, 2024-09-11, author brandon@pixelandtonic.com). The target version 4.18.9 already includes this fix from the upstream release. Line 136 of FileHelper.php contains 'return static::normalizePath($from . $ds . $to, $ds);', which is the fixed version that prevents directory traversal attacks. The vulnerable pattern (raw concatenation without normalization) is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-23209 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-23209" }, "impact_statement": "The target repository (Craft CMS 4.18.9) is not affected by CVE-2025-23209. The vulnerable method UpdaterController::actionRestoreDb() has been completely disabled and now throws NotSupportedException, preventing any path traversal attack that could lead to RCE. This fix was already present in upstream Craft CMS 4.18.9 before TuxCare onboarded the version. The fixing commit a19d46be78 by brandon@pixelandtonic.com (upstream vendor) shipped in the 4.18.9 release, which TuxCare subsequently onboarded via snapshot commit b1a16b0026." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2025-32432 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-32432" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is not affected by CVE-2025-32432. The RCE vulnerability, which exploited missing type validation on the transform handle parameter, was fixed in upstream version 4.14.15. The fix is present in the target's version 4.18.9, which was imported via snapshot commit b1a16b0026 on 2026-09-24. The type check at src/controllers/AssetsController.php:1208-1210 prevents non-string values (objects/arrays) from reaching the vulnerable ImageTransforms::normalizeTransform() method, blocking the RCE attack vector." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-46731 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-46731" } }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-57811 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-57811" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68436 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68436" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is NOT vulnerable to CVE-2025-68436. The fix that prevents mass assignment of the photoId attribute was released upstream in Craft CMS version 4.16.17 (December 2025). Version 4.18.9, released September 2026, inherits this fix. The defense code (safeAttributes() method removing 'photoId' from mass-assignable attributes) is present in the target at src/elements/User.php:924..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68437 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68437" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is not affected by CVE-2025-68437 (SSRF via GraphQL save__Asset mutation). The vulnerable pattern is not present because the upstream 4.18.9 release already includes comprehensive SSRF protection via the craftcms/url-validator package. The fix validates URLs and rejects those containing IP addresses or targeting internal resources before any connection is ma..." }, { "status": "affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2025-68454" }, "action_statement": "Vulnerability CVE-2025-68454 affects version 4.18.9-p1+tuxcare of craftcms/cms." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2025-68455 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68455" }, "impact_statement": "The target version 4.18.9 is not affected by CVE-2025-68455. The vulnerability was fixed by the upstream vendor in version 4.16.17 (released 2025-12-04) via commits that add Component::cleanseConfig() calls to sanitize configuration arrays before object instantiation. Version 4.18.9 (released 2026-09-17) already contains these fixes from the upstream vendor. The fix prevents RCE via malicious Yii2 behaviors by removing \"on \" and \"as \" keys from user-provided configuration arrays, which would otherwise allow attackers to attach malicious behaviors or event handlers to dynamically configured objects." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2025-68456 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-68456" }, "impact_statement": "The target repository (craftcms/cms version 4.18.9) is NOT AFFECTED by CVE-2025-68456. The upstream vendor fix that prevents unauthenticated database backup triggering is already present in the codebase at src/controllers/UpdaterController.php lines 72-75. This fix was shipped in upstream release 4.18.9 (commit 1718011a5f by brandon@pixelandtonic.com) before TuxCare onboarded the version. The fix adds a precondition check that only allows the actionBackup() method to execute database backups when migrations are pending, effectively preventing the DoS attack via repeated arbitrary backup requests described in the CVE." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25491 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0...", "vulnerability": { "name": "CVE-2026-25491" }, "impact_statement": "not_affected \u2014 Craft CMS 4.18.9 is not affected by CVE-2026-25491. While the Twig template does not apply the |e escape filter to entry type names (line 28 of _entrytypes/index.twig), the architecture uses Vue.js client-side rendering with automatic HTML escaping via {{ }} interpolation syntax (App.vue:115,120). Additionally, JSON encoding provides JavaScript context protection. The CVE affects versions 5.0.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25493 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25493" }, "impact_statement": "not_affected \u2014 CVE-2026-25493 (SSRF via HTTP redirect bypass) is NOT present in craftcms/cms 4.18.9. The target version already contains the upstream vendor fix (RequestOptions::ALLOW_REDIRECTS => false) from Craft CMS 4.16.18+. The vulnerability affected versions 4.0.0-RC1 through 4.16.17; target version 4.18.9 is beyond the patched threshold. The fix was implemented by Pixel & Tonic (upstream vendor) in com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25494 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25494" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-25494. The vulnerability (hex-encoded IP bypass in saveAsset GraphQL mutation) was fixed in upstream version 4.16.18 (Jan 2026). TuxCare's snapshot of 4.18.9 (Sep 2026) already includes the fix via the craftcms/url-validator package v1.0.0, which contains hex-to-decimal normalization and cloud metadata blocklists. The vulnerable pattern (relying..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-25495 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25495" }, "impact_statement": "The target (craftcms/cms v4.18.9) is NOT AFFECTED by CVE-2026-25495. The SQL injection vulnerability described in the CVE has been fixed by the upstream vendor (Pixel & Tonic) in version 4.17.4. The fix was already present when TuxCare onboarded version 4.18.9. The defense mechanism `ElementHelper::cleanseQueryCriteria()` removes dangerous SQL clause parameters (orderBy, where, select, from, groupBy, join, having, union, withQueries, params) from user-supplied criteria before database query construction, preventing arbitrary SQL injection. This is an upstream vendor fix, not a TuxCare backport, hence verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-25496 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25496" }, "impact_statement": "not_affected \u2014 CVE-2026-25496 is NOT present in Craft CMS 4.18.9. The stored XSS vulnerability in Number field prefix/suffix rendering has been fixed by the upstream vendor. The target's Number/input.twig template includes the security fix (encode=true parameter added to the md filter on lines 28 and 43), which HTML-encodes prefix/suffix values before Markdown processing, preventing script injection. This fix..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-25498 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25498" }, "impact_statement": "CVE-2026-25498 (GHSA-7jx7-3846-m7w7) is NOT present in the target. The vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.16.17, where assembleLayoutFromPost() in src/services/Fields.php fails to sanitize user-supplied configuration data, allowing RCE via Yii2 behavior injection. The fix was released in upstream Craft CMS 4.16.18 (2026-01-09), adding ComponentHelper::cleanseConfig() to remove malicious \"on \" and \"as \" prefixed configuration keys. The target version 4.18.9 (released 2026-09-17) already includes this upstream fix. Analysis confirmed the fix is present at Fields.php:1286, and it was imported during the snapshot/onboarding of version 4.18.9, not added by TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27126 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27126" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 contains the complete XSS fix that was released upstream in Craft CMS 4.16.19. The fix includes three defenses: (1) a typeOptions() whitelist excluding 'html' as a valid column type, (2) validateColumns() that rejects unsupported column types and defaults them to 'singleline', and (3) HTML encoding of 'heading' column values in _getInputHtml(). All three fixes are present ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-27127 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27127" }, "impact_statement": "Target version 4.18.9 is NOT AFFECTED by CVE-2026-27127 (DNS rebinding TOCTOU SSRF vulnerability). The upstream Craft CMS 4.18.9 release already contains the complete DNS pinning fix that prevents DNS rebinding attacks. The fix implements both CURLOPT_RESOLVE to pin DNS resolution and ON_STATS callback to validate the actual connected IP, eliminating the TOCTOU vulnerability between validation and request." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27128 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27128" }, "impact_statement": "not_affected \u2014 The target (Craft CMS 4.18.9) is NOT AFFECTED by CVE-2026-27128. The TOCTOU race condition vulnerability in token validation has already been fixed by the upstream vendor. The fix (mutex-based synchronization wrapping the read-check-update sequence in getTokenRoute()) was included in upstream release 4.16.19 and is present in the target's version 4.18.9. TuxCare onboarded version 4.18.9 via sna..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-27129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-27129" }, "impact_statement": "not_affected \u2014 CVE-2026-27129 describes an IPv6 bypass vulnerability in Craft CMS versions that use inline SSRF validation with gethostbyname(), which only resolves IPv4 addresses. When a hostname has only AAAA (IPv6) records, gethostbyname() returns the hostname string unchanged, bypassing IP blocklist checks. However, the target (version 4.18.9) uses a fundamentally different architecture: it delegates all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T12:41:00.266160+00:00", "status_notes": "Vulnerability CVE-2026-31857 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31857" }, "impact_statement": "CVE-2026-31857 affects Craft CMS versions prior to 4.17.4 and 5.9.9. The target is version 4.18.9, which already contains the upstream fix. The vulnerable code in BaseElementSelectConditionRule::getElementId() that used unsandboxed renderObjectTemplate() has been replaced with renderSandboxedObjectTemplate(). The complete Twig sandbox infrastructure with SecurityPolicy allowlist enforcement is present. The fix was shipped in upstream version 4.17.4 (released 2026-02-11), seven months before the target's base version 4.18.9 (released 2026-09-17)." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-31858 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31858" }, "impact_statement": "CVE-2026-31858 affects ElementSearchController::actionSearch(), which does not exist in Craft CMS 4.18.9. ElementSearchController was introduced in version 5.8.0 (April 2026), while the target is version 4.18.9 from the 4.x release line. The vulnerable component is not present in this version. Additionally, ElementIndexesController (the only controller in 4.18.9 that processes user-supplied criteria parameters from HTTP requests) applies the cleanseQueryCriteria() defense, which removes dangerous SQL-construction attributes (where, orderBy, select, join, having, union, params) before passing criteria to query configuration." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-31859 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-31859" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS 4.18.9) is NOT affected by CVE-2026-31859. The vulnerability pattern (accepting dangerous URL schemes like `javascript:` in return URLs) is not present because the upstream vendor fixed it in commit cc9921c148 (Feb 6, 2026) before the 4.18.9 release. TuxCare onboarded version 4.18.9 on Oct 3, 2026, which already contained the fix. The setReturnUrl() method at sr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-32262 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32262" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is NOT affected by CVE-2026-32262. The vulnerability, a path traversal issue in the AssetsController->replaceFile() method allowing authenticated users to delete arbitrary files via the targetFilename parameter, was fixed in upstream version 4.17.5. The target version 4.18.9 is a later release that already contains the complete upstream fix. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-32263 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-32263" }, "impact_statement": "Version 4.18.9 is not affected by CVE-2026-32263. The vulnerability exists in EntryTypesController.php::actionApplyOverrideSettings(), which was introduced in Craft CMS version 5.0 (commit 0885de776b \"Globalize entry types\"). This file and method do not exist in version 4.x. In version 4.18.9, entry type functionality is handled in SectionsController.php using manual property assignment rather than bulk configuration via Craft::configure(). All uses of Craft::configure() with HTTP request data in version 4.x controllers are protected by Component::cleanseConfig(), preventing Yii2 behavior/event handler injection. The vulnerable architectural pattern (parse_str \u2192 unsanitized array \u2192 Craft::configure) that enables the attack does not exist in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32264 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32264" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32264 (GHSA-4484-8v2f-5748). The RCE vulnerability in ElementIndexesController and FieldsController was fixed by the upstream vendor (Pixel & Tonic) in version 4.17.5 (released February 2026). The target version 4.18.9 (released September 2026) already includes these security fixes as part of the upstream release that TuxCare onboarded. Both vulnerable code paths now properly sanitize configuration arrays with Component::cleanseConfig() before object instantiation, preventing the behavior injection attack." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-32267 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-32267" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-32267. The vulnerability was fixed in upstream version 4.17.6, and the target version 4.18.9 (released after 4.17.6) already contains the complete security fix. The fix prevents privilege escalation by enforcing route-specific token validation: tokens are now bound to specific routes and cannot be reused to access unintended endpoints like UsersController->actionImpersonateWithToken." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33051 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33051" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is NOT affected by CVE-2026-33051. The vulnerability exists in versions 5.9.0-beta.1 through 5.9.10 due to Template::raw() bypassing Twig's auto-escaping when rendering unencoded creator names. Version 4.18.9 uses a fundamentally different architecture (Twig templates with automatic HTML escaping) that was refactored into the vulnerable PHP-generated approach starting in version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:48:00.109414+00:00", "status_notes": "Vulnerability CVE-2026-33157 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33157" }, "impact_statement": "Craft CMS version 4.18.9 is not affected by CVE-2026-33157. The specific vulnerability (unsanitized fieldLayouts parameter in ElementIndexesController::actionFilterHud() passed to FieldLayout::createFromConfig()) does not exist in this version. The actionFilterHud() method in 4.18.9 only processes conditionConfig parameters (which ARE sanitized at line 421), and has no fieldLayouts parameter handling at all. The vulnerable code path introduced in Craft 5.6.0 is architecturally absent from the 4.x branch. All HTTP-accessible entry points that process field layout configurations call Component::cleanseConfig() before passing data to object creation methods." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33158 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33158" }, "impact_statement": "not_affected \u2014 The target repository (Craft CMS version 4.18.9) is not affected by CVE-2026-33158. This vulnerability affects Craft CMS versions 4.0.0-RC1 through 4.17.7, allowing low-privileged authenticated users to read private asset content by calling the assets/edit-image endpoint with arbitrary assetIds without proper authorization checks. The vulnerability was fixed in upstream version 4.17.8 by adding..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33159 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33159" }, "impact_statement": "not_affected \u2014 CVE-2026-33159 affects Craft CMS 4.0.0-RC1 to before 4.17.8, allowing unauthenticated users to execute privileged Config Sync operations. The target repository is at version 4.18.9, which includes the upstream fix released in 4.17.8. The ConfigSyncController contains the required authentication gates ($allowAnonymous=ALLOW_ANONYMOUS_NEVER and requireAdmin() in beforeAction hook) that block all ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33160 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33160" }, "impact_statement": "not_affected \u2014 CVE-2026-33160 affects Craft CMS versions 4.0.0-RC1 to before 4.17.8. The target version 4.18.9 already contains the upstream vendor's fix (requirePermission('accessCp') check at line 1205 of AssetsController.php) that prevents unauthorized access to asset transform generation. The fix was shipped in upstream release 4.18.9 before TuxCare onboarded this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33161 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-33161" }, "impact_statement": "not_affected \u2014 The target repository (craftcms/cms version 4.18.9, SHA 018c9bb626) is NOT AFFECTED by CVE-2026-33161. The vulnerability\u2014an authorization bypass allowing low-privileged users to access private asset metadata via the assets/image-editor endpoint\u2014was fixed by the upstream vendor (Craft CMS) in commit d30df31122 on February 25, 2026. This fix was included in version 4.17.8 and all subsequent relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-33162 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-33162" }, "impact_statement": "not_affected \u2014 Craft CMS version 4.18.9 is NOT affected by CVE-2026-33162. The vulnerability concerns an authorization bypass in the \"move entry to section\" feature that allows users with only accessCp permission to move entries between sections without saveEntries permission. This feature was introduced in version 5.3.0 (commit e75a51a266) and does not exist in version 4.18.9. Git ancestry verification confi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41129 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41129" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset mutations). The upstream vendor refactored asset upload URL validation to use the craftcms/url-validator package (commit 26268c0210, June 2026), which validates URL schemes and blocks dangerous protocols (gopher, file, ftp, etc.) before any connection is opened. This fix was already present in the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-41130 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41130" }, "impact_statement": "not_affected \u2014 The target version 4.18.9 is NOT AFFECTED by CVE-2026-41130 (GHSA-95wr-3f2v-v2wh). The vulnerable `actionResourceJs()` method in `src/controllers/AppController.php` does not exist in this version. Upstream Craft CMS removed this endpoint entirely in version 4.18.0 (released May 13, 2026), which predates TuxCare's onboarding of version 4.18.9. The SSRF attack chain is broken at the INPUT stage b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-55790 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-55790" }, "impact_statement": "CVE-2026-55790 XSS vulnerability in CraftSupport widget is NOT present in target version 4.18.9. The fix was included in upstream release 4.17.16 (2026-05-11) and is present at both vulnerable locations: (1) line 382 uses Craft.escapeHtml() to escape GitHub issue titles before rendering, and (2) lines 555-557 use jQuery's text: option for error messages. The target version 4.18.9 (released 2026-09-17) includes this upstream vendor fix. TuxCare onboarded the already-fixed version via snapshot commit b1a16b0026." }, { "status": "fixed", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-55793 is fixed in version 4.18.9-p1+tuxcare of craftcms/cms.", "vulnerability": { "name": "CVE-2026-55793" } }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56381 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte...", "vulnerability": { "name": "CVE-2026-56381" }, "impact_statement": "not_affected \u2014 Version 4.18.9 is not affected by CVE-2026-56381. While the code has missing |e filters in some Twig templates (src/templates/settings/users/groups/_index.twig line 29), three layers of ambient framework defenses provide comprehensive protection: (1) Twig's default HTML auto-escaping for server-side rendering, (2) JSON string escaping preventing JavaScript injection, and (3) Vue's mustache inte..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:47:00.161204+00:00", "status_notes": "Vulnerability CVE-2026-56382 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56382" }, "impact_statement": "Target version 4.18.9 is NOT affected by CVE-2026-56382. The vulnerable method actionRenderCardPreview() was introduced in version 5.5.0, after this version. The CVE's stated affected range (>= 5.5.0 and <= 5.9.13) correctly excludes version 4.18.9. No alternative vulnerable code path exists in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56383 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56383" }, "impact_statement": "not_affected \u2014 The target Craft CMS 4.18.9 is NOT AFFECTED by CVE-2026-56383 (stored XSS in Table field row headings). The vulnerability was fixed by the upstream vendor (Pixel & Tonic) in version 4.16.19, and this fix is present in version 4.18.9. The fix HTML-encodes heading cell values in _getInputHtml() before rendering, preventing XSS. The vulnerable pattern does not exist in the target because the upstr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56384 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56384" }, "impact_statement": "not_affected \u2014 CVE-2026-56384 affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7, and was fixed in 4.17.8. The target repository is at version 4.18.9, which already contains the upstream vendor fix. The vulnerability involved missing authorization checks in the assets/preview-thumb and assets/preview-file endpoints. Both methods now include requireVolumePermissionByAsset() and requirePeerVolumePermissionByAss..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-14T14:57:00.115773+00:00", "status_notes": "Vulnerability CVE-2026-56385 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56385" }, "impact_statement": "not_affected \u2014 Target version 4.18.9 is not affected by CVE-2026-56385. The vulnerability affects Craft CMS versions <= 4.17.7, with the fix released in 4.17.8. Version 4.18.9 already includes the upstream fix (permission checks in actionPreviewFile method at lines 1258-1259) that was shipped in the upstream release before TuxCare onboarded this version. The authorization bypass vulnerability pattern is not p..." }, { "status": "not_affected", "products": [ { "@id": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare", "identifiers": { "purl": "pkg:composer/craftcms/cms@4.18.9-p1+tuxcare" } } ], "timestamp": "2026-10-16T10:49:00.133271+00:00", "status_notes": "Vulnerability CVE-2026-56394 does not affect version 4.18.9-p1+tuxcare of craftcms/cms. Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-56394" }, "impact_statement": "Target version 4.18.9 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint was fixed in upstream Craft CMS version 4.17.5 (released 2026-02-17), and version 4.18.9 (released 2026-09-17) inherits this fix. All three entry points (iconUrl, iconPath, iconSvg) validate the extension parameter using regex /^\\w+$/ to reject path traversal sequences before constructing file paths." } ] }