Craftcms Craft Cms
CVE-2026-29113
Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.3 and 5.9.7.
What this means for your business
- It affects Craftcms Craft Cms. It matters if your company, or a supplier that handles your data, runs it.
- An attacker can use it remotely, over a network, without a login, but only after tricking someone into an action such as opening a file or a link.
What to do
- 1Check whether your company or your suppliers run Craftcms Craft Cms, and which version. The affected versions are listed further down this page.
- 2If you do, apply the vendor's fix. A patch or vendor advisory has been published.
Not sure if your company is exposed?
Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.
Scoring
- CVSS
- 4.3 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N- CVSS v4
- 2.3
- Weakness
- CWE-352
- Assigned by
- security-advisories@github.com
Dates
- Published
- 2026-03-10
- Last modified
- 2026-09-02
- Sources
- NVD
Affected products
- Craftcms Craft Cms4.0.0 - 4.17.4, 5.0.0 - 5.9.7
As listed in the NVD configuration data. Not a statement about your estate.