Vulnerabilidades de Masacms

CVEs publicadas que afetam produtos de Masacms: 12 registro(s), com severidade, exploração e correções.

CVE-2026-40332 Média · 5.3 CWE-601 06/05/2026

Masa CMS open redirect via improper handling of scheme-relative URLs

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs. The application incorrectly interprets paths beginning with double slashes (//) as internal paths, failing to validate the redirect target before processing. The application treats these values as internal paths and processes them without confirming that the redirect target remains on the local site. An attacker can craft a URL on the trusted Masa CMS domain that redirects a victim to an external attacker-controlled site. This can be used for phishing and, in some authentication flows, may expose tokens or other sensitive data to the external site. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, reject or rewrite redirect parameters that begin with // and consider disabling forceDirectoryStructure if compatible with the deployment.

CVE-2026-40326 Alta · 7.1 CWE-352 06/05/2026

Masa CMS CSRF in site bundle creation allows unauthorized site data export

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in `csettings.cfc` does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or link that, when visited by a logged-in administrator, triggers the silent creation of a comprehensive site bundle. This bundle is saved to a predictable, publicly accessible web directory. An unauthenticated attacker can then retrieve the bundle and obtain site content, user account data, password hashes, form submissions, email lists, plugins, and configuration data. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, remove unexpected bundle files from public directories, restrict access to the affected endpoint, and limit exposure of administrative sessions.

CVE-2026-40325 Alta · 8.7 CWE-352 06/05/2026

Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted items from the trash and places them at an attacker-controlled location in the site structure through the parentid parameter. This can restore previously deleted malicious or outdated content, expose sensitive documents by moving them into publicly accessible locations, and disrupt site structure or content integrity. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.

CVE-2026-40309 Alta · 7.2 CWE-352 06/05/2026

Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request that empties the trash and permanently deletes all deleted content. This can cause irreversible data loss and disrupt recovery of content intended for restoration. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and maintain current database backups to recover from unauthorized deletion.

CVE-2026-40174 Alta · 7.1 CWE-352 06/05/2026

Masa CMS CSRF in user address management allows unauthorized address changes

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations. An attacker can induce a logged-in administrator to submit a forged request that adds, modifies, or deletes user address records, including email addresses and phone numbers. This can be used to alter contact information, redirect organizational communications, and corrupt address data in the user directory. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, or deploy filtering rules to block forged requests to the affected endpoint

CVE-2026-40331 Crítica · 9.3 CWE-89 05/05/2026

Injeção de SQL no Masa CMS via parâmetro altTable da API JSON não autenticada

O Masa CMS é um sistema de gerenciamento de conteúdo de código aberto. Nas versões 7.2.0 até 7.2.9, 7.3.0 até 7.3.14, 7.4.0 até 7.4.9 e 7.5.0 até 7.5.2, a API JSON não autenticada aceita um parâmetro altTable que é armazenado pelo método setAltTable() sem validação ou sanitização. Esse valor é injetado diretamente em uma cláusula FROM de SQL dentro de feedGateway.cfc. Um atacante não autenticado pode passar uma subconsulta arbitrária no parâmetro altTable para ler dados sensíveis de qualquer tabela do banco de dados em uma única requisição HTTP, incluindo credenciais administrativas e tokens de redefinição de senha. Este problema foi corrigido nas versões 7.2.10, 7.3.15, 7.4.10 e 7.5.3. Como solução alternativa, aplique validação à função setAltTable em core/mura/content/feed/feedBean.cfc para restringir a entrada a nomes de tabela simples alfanuméricos, ou desative a API JSON caso ela não seja necessária.

CVE-2026-40330 Crítica · 9.3 CWE-89 05/05/2026

Injeção de SQL no Masa CMS via parâmetro sortDirection do beanFeed.cfc (CVE-2026-40330)

Masa CMS é um sistema de gerenciamento de conteúdo de código aberto. Nas versões 7.2.0 até 7.2.9, 7.3.0 até 7.3.14, 7.4.0 até 7.4.9 e 7.5.0 até 7.5.2, existe uma vulnerabilidade de injeção de SQL no componente beanFeed.cfc, no tratamento do parâmetro sortDirection dentro da função getQuery. O valor do parâmetro é concatenado diretamente em consultas SQL, sem sanitização ou parametrização. Um atacante remoto não autenticado pode explorar isso para extrair informações sensíveis, modificar ou excluir registros do banco de dados ou, potencialmente, alcançar execução remota de código no servidor de banco de dados subjacente. Esse problema foi corrigido nas versões 7.2.10, 7.3.15, 7.4.10 e 7.5.3. Como solução de contorno, use um WAF para bloquear ou restringir o acesso ao componente beanFeed.cfc, ou implemente regras para detectar padrões de injeção de SQL direcionados ao parâmetro sortDirection.

CVE-2026-40329 Crítica · 9.3 CWE-89 05/05/2026

Injeção de SQL no Masa CMS no parâmetro sortBy de beanFeed.cfc (CVE-2026-40329)

O Masa CMS é um sistema de gerenciamento de conteúdo de código aberto. Nas versões 7.5.2 e anteriores, existe uma vulnerabilidade de injeção de SQL no componente beanFeed.cfc, no processamento do parâmetro sortBy pela função getQuery. A aplicação não sanitiza nem parametriza adequadamente essa entrada antes de incorporá-la em instruções SQL dinâmicas. Um atacante remoto não autenticado pode executar comandos SQL arbitrários contra o banco de dados, potencialmente obtendo acesso a dados sensíveis, modificando ou excluindo registros, ou escalando privilégios até o controle administrativo. Esse problema foi corrigido nas versões 7.2.10, 7.3.15, 7.4.10 e 7.5.3. Como solução paliativa, configure regras de WAF para bloquear padrões maliciosos de SQL no parâmetro sortBy enviado ao beanFeed.cfc.

CVE-2025-66492 Média · 6.1 CWE-79 12/12/2025

Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.

CVE-2024-32643 Alta · 7.5 CWE-863 03/12/2025

Masa CMS vulnerable to authentication bypass with /tag/

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

CVE-2024-32642 Alta · 8.8 CWE-346 03/12/2025

Host header poisoning allows account takeover via password reset email

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.

CVE-2024-32641 Crítica · 9.8 CWE-94 03/12/2025

Masa CMS Vulnerable to Pre-Auth RCE via JSON API

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.