Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

GHSA-vg3j-hpm9-8v5v — craftcms/cms

Fix: craftcms/cms@6a88468

GHSA-vg3j-hpm9-8v5v is a Cross-Site Request Forgery (CSRF) vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below.

Craft CMS has a potential information disclosure vulnerability in preview tokens

Also known asCVE-2026-29113
Published
Mar 10, 2026
Updated
Sep 2, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Sep 18, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-vg3j-hpm9-8v5v.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs7th percentile — riskier than 7% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Real-World Exposure

2 pkgs affected
🐘craftcms/cms🐘craftcms/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken.

Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker.

That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope.

Preconditions

  • Victim is logged in to Craft control panel.
  • Victim has active preview authorization in session for target content (e.g., opened/edited an entry).
  • The attacker must know the target’s canonicalId and public URL path of that entry.

1) Attacker prepares a fixed token

Use any 32-character value, for example:

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

2) CSRF victim into minting that token

Send the victim a link (or top-level redirect) such as:

https://TARGET/actions/preview/create-token?elementType=craft%5Celements%5CEntry&canonicalId=123&siteId=1&previewToken=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&redirect=https%3A%2F%2FTARGET%2F

If the victim is logged in and authorized for previewElement:123, Craft creates that exact token.

3) Attacker accesses preview content unauthenticated

curl -i 'https://TARGET/news/known-entry-slug?token=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'

Expected vulnerable behavior:

  • Response renders preview/unpublished state (draft/provisional context), not just normal public content.

Impact

  • CSRF-based minting of attacker-known preview tokens.
  • Unauthorized access to draft/provisional/revision content via token replay.
  • Stealthy one-click exploitation against logged-in editors/admins.
  • No dependency on forwarded-host poisoning.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcraftcms/cms≥ 4.0.0-RC1&&< 4.17.34.17.3composer require craftcms/cms:^4.17.3
🐘Packagistcraftcms/cms≥ 5.0.0-RC1&&< 5.9.75.9.7composer require craftcms/cms:^5.9.7

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update craftcms/cms to 4.17.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vg3j-hpm9-8v5v is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-vg3j-hpm9-8v5v can be triaged on real exposure rather than presence alone.

Tailored to GHSA-vg3j-hpm9-8v5v. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

# Summary Craft CMS has a CSRF issue in the preview token endpoint at `/actions/preview/create-token`. The endpoint accepts an attacker-supplied `previewToken`. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. --- ## Preconditions - Victim is logged in to Craft control panel. - Victim has active preview authoriz
O3 Security · Impact-Aware SCA

Is GHSA-vg3j-hpm9-8v5v in your dependencies?

O3 Security finds GHSA-vg3j-hpm9-8v5v across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-vg3j-hpm9-8v5v: craftcms/cms CSRF | O3 Security