{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:13383f63-cab9-530b-bbe7-25798a6ae33d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "cms", "purl": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "type": "library", "group": "craftcms", "bom-ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare", "version": "4.18.7-p1+tuxcare", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-37251", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:4362a662-2e6d-5750-b95f-5bcfc4005f07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-37251 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2022-37251 (XSS via Drafts) affected Craft CMS 4.2.0.1 due to missing HTML encoding on user-controllable content (revision notes, tab names, group names, address titles). The vulnerability was fixed by upstream Craft CMS developers (Pixel & Tonic) in version 4.2.1 (released 2022-08-09) via commits that added Html::encode() to all affected output locations. Target version 4.18.7 inherits the...", "justification": "code_not_present" } }, { "id": "CVE-2024-41800", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:769ebb17-676a-5193-ab8c-39cc0136569b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-41800 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository is Craft CMS version 4.18.7, while CVE-2024-41800 specifically affects Craft CMS 5's TOTP (Time-based One-Time Password) two-factor authentication feature. The TOTP 2FA functionality does not exist in Craft CMS 4.x at all. Exhaustive searches across the entire codebase found no TOTP-related code, no Google2FA library dependency, no auth/methods directory structure, no Auth...", "justification": "code_not_present" } }, { "id": "CVE-2024-52293", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:d4969459-e062-5669-85a8-75b42bcda150", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-52293 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2024-52293 is NOT present in the target. The vulnerability required missing normalizePath() in FileHelper::absolutePath() line 136, allowing path traversal sequences like `../templates/poc` to bypass system directory security checks. The target code contains the upstream vendor's fix: `return static::normalizePath($from . $ds . $to, $ds);` which resolves traversal sequences before the path is used in security validations. This fix was introduced in upstream Craft CMS version 4.12.2 (commit 123e48a696 by brandon@pixelandtonic.com on 2024-09-11). The target version 4.18.7 naturally includes all fixes from 4.12.2. TuxCare onboarded the pre-fixed version 4.18.7; there is no separate TuxCare backport for this CVE on this version line.", "justification": "code_not_present" } }, { "id": "CVE-2025-23209", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:cad3badf-152d-5d3e-b5ed-cd8a2257d638", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-23209 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-23209 fix a19d46be78a9 by brandon@pixelandtonic.com (2025-07-07) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2025-32432", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:b4a532cb-cb3e-57d5-9221-d709c36cbdf7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-32432 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2025-32432 RCE vulnerability is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this type confusion vulnerability in commit e1c85441 (2025-04-10) by adding string type validation for the 'handle' parameter in AssetsController::actionGenerateTransform(). This fix was included in upstream release 4.18.7 (2026-08-18), which TuxCare subsequently onboarded to ELS on 2026-09-07. The target code at HEAD (b16f3f8a9b) contains the complete fix: lines 1208-1210 validate that $handle is a string before use, exactly matching the vendor patch. The CVE affects versions 4.0.0-RC1 to before 4.14.15; target version 4.18.7 is after the fixed version. Attribution: upstream vendor fix (no TuxCare authorship signal).", "justification": "code_not_present" } }, { "id": "CVE-2025-46731", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:8d817f36-6c4b-558d-b2f9-637e3e5b657f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-46731 affects version 4.18.7-p1+tuxcare of craftcms/cms." } }, { "id": "CVE-2025-57811", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:7bc16df8-f6a9-5c1a-bb19-c4bca99740ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-57811 affects version 4.18.7-p1+tuxcare of craftcms/cms." } }, { "id": "CVE-2025-68436", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:d6a913c0-37e8-5eda-9f93-343b210ad033", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68436 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68436 fix 4bcb0db554e2 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2025-68437", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:e5d453e7-de84-580f-a39b-326c4dc4a0f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68437 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68437 fix 013db636fdb3 by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2025-68454", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:a8c6f086-18a5-5681-9e43-44c011794e42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-68454 affects version 4.18.7-p1+tuxcare of craftcms/cms." } }, { "id": "CVE-2025-68455", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:65d12d35-2df0-5ffd-8560-15685e610296", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68455 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is not affected by CVE-2025-68455. The vulnerability was fixed by upstream vendor (Craft CMS/Pixel & Tonic) in version 4.16.17 via commit ec43c497ed (released 2025-12-04). Target version 4.18.7 (released 2026-08-18) is newer and includes this fix plus additional hardening. The fix adds Component::cleanseConfig() to remove dangerous config keys (\"on \" event handlers and \"as \" behaviors) before object instantiation, preventing malicious behavior attachment and RCE. TuxCare later adopted version 4.18.7 into their ELS program, inheriting the upstream fix.", "justification": "code_not_present" } }, { "id": "CVE-2025-68456", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:2c020da2-3419-56f6-b454-11517aa1da81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-68456 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2025-68456 fix 1718011a5faa by brandon@pixelandtonic.com (2025-12-04) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2026-25491", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:d3ab1c0e-be5b-577f-9e5c-b5981d9143a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25491 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Version 4.18.7 is NOT AFFECTED by CVE-2026-25491. The vulnerability (stored XSS via unescaped entry type names) affects Craft CMS 5.0.0-RC1 through 5.8.21, where the architecture changed from Vue.js client-side rendering to PHP server-side rendering. In version 4.18.7, entry type names are rendered through Vue.js's default {{ }} interpolation (App.vue:115,120), which automatically applies HTML ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-25493", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:28f05ea8-107f-563c-b819-9547378ea5b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25493 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-25493. The upstream vendor fixed this SSRF redirect bypass vulnerability in commit 26268c0210 (June 2026), which was included in the 4.18.7 release (August 2026). The target code disables HTTP redirects at line 318 (`RequestOptions::ALLOW_REDIRECTS => false`) in the downloadUrl method, preventing attackers from bypassing validation ...", "justification": "code_not_present" } }, { "id": "CVE-2026-25494", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:c71e325d-6a31-5dc4-bc74-6355731b1aaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25494 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-25494 describes a hex IP notation bypass of filter_var() validation in the saveAsset GraphQL mutation. The target (4.18.7) is NOT AFFECTED because the vulnerable code pattern has been completely replaced by an upstream vendor refactoring. On June 15, 2026, upstream author brandon@pixelandtonic.com (commit 26268c0210) replaced the inline filter_var() validation with the craftcms/url-val...", "justification": "code_not_present" } }, { "id": "CVE-2026-25495", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:857c7e79-8071-52ed-80a8-671342394c27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25495 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Craft CMS 4.18.7 is not affected by CVE-2026-25495. The upstream vendor (Pixel & Tonic) fixed this SQL injection vulnerability in version 4.16.18 (released 2026-01-09) by removing dangerous SQL query construction parameters from user-provided criteria before database query configuration. The fix was refactored into ElementHelper::cleanseQueryCriteria() in version 4.17.4 (released 2026-02-11). The target version 4.18.7 (released 2026-08-18) inherits this upstream fix. The vulnerable pattern is not present in the target because an upstream-authored fix is already applied in the shipped version.", "justification": "code_not_present" } }, { "id": "CVE-2026-25496", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:706751dd-ab0b-59bf-9ffa-0f98c87170e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25496 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected by CVE-2026-25496. The upstream vendor (Craft CMS / Pixel & Tonic) fixed the stored XSS vulnerability in commit 93837b626f on 2026-01-05 by adding HTML encoding to the Number field's Prefix and Suffix rendering. This fix was included in the upstream 4.18.7 release (finalized 2026-08-18), which TuxCare inherited when onboarding this version. The vulnerable p...", "justification": "code_not_present" } }, { "id": "CVE-2026-25498", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:b996c29f-fa4b-5844-b29c-2da976b693ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25498 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not vulnerable to CVE-2026-25498. The upstream vendor (Pixel & Tonic) fixed the RCE vulnerability in commit 395c64f0b8 on 2026-01-09 by adding ComponentHelper::cleanseConfig() sanitization before passing user-supplied field layout configuration to object creation. This fix was included in the upstream 4.18.7 release (2026-08-18) which TuxCare subsequently onboarded for Extended Lifecycle Support. The vulnerable pattern (unsanitized config data passed directly to createLayout) is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2026-27126", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:a356ad3f-194b-5534-95a4-df09800a248f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27126 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (CVE-2026-27126) affecting versions 4.5.0-RC1 through 4.16.18 was patched in upstream version 4.16.19. The target version 4.18.7 inherited the complete fix from upstream commit f5d488d9bb (authored by brandon@pixelandtonic.com on 2026-01-14). The fix validates table column types against a whitelist and converts unsupported types (includin...", "justification": "code_not_present" } }, { "id": "CVE-2026-27127", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:06e369a0-43fb-57fc-be73-8e0cde7841e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27127 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target (craftcms/cms 4.18.7) is NOT vulnerable to CVE-2026-27127 (DNS rebinding TOCTOU SSRF). The upstream vendor (Pixel & Tonic) deployed a comprehensive fix in commit 26268c0210 (June 15, 2026) that implements DNS pinning via CURLOPT_RESOLVE and pre-validates IPs through the craftcms/url-validator package. This fix was naturally included in version 4.18.7 (released August 18, 2026). The vulnerable pattern (separate DNS lookups without pinning) has been completely removed from the codebase. This is a vendor-authored fix, not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-27128", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:4dd823d6-4d5f-5713-b2f6-42a5605e20c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27128 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository at version 4.18.7 is NOT vulnerable to CVE-2026-27128. The TOCTOU race condition fix was applied by the upstream vendor (Pixel & Tonic) in commit 3e4afe1827 as part of version 4.16.19 (released 2026-01-15). Version 4.18.7, being newer than 4.16.19, naturally includes this fix. The getTokenRoute() method in src/services/Tokens.php correctly uses mutex locking to ensure atom...", "justification": "code_not_present" } }, { "id": "CVE-2026-27129", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:203f59f0-9903-5bc9-9dba-6bb8106ea9be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-27129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is NOT AFFECTED by CVE-2026-27129. The vulnerable pattern (using gethostbyname() which only resolves IPv4) is absent because the upstream vendor refactored the code to use the craftcms/url-validator library (commit 26268c0210, Jun 2026). This library uses dns_get_record() with both DNS_A and DNS_AAAA records, and includes comprehensive IPv6 validation via FILTER_FL...", "justification": "code_not_present" } }, { "id": "CVE-2026-31857", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:9dceda53-0523-5e91-8761-beb5ff4e8de4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-31857 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. The target craftcms/cms 4.18.7 contains the upstream vendor fix for CVE-2026-31857. The vulnerable unsandboxed Twig rendering call has been replaced with the sandboxed version in BaseElementSelectConditionRule.php line 88. Fix commit 8d4903647d was authored by brandon@pixelandtonic.com (Craft CMS upstream vendor) as part of the 4.17.4 release, and is included in the 4.18.7 version onboarded by TuxCare.", "justification": "code_not_present" } }, { "id": "CVE-2026-31858", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:389c26e9-5793-5613-8581-fe7c11fbaf81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-31858 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-31858 does not affect Craft CMS version 4.18.7. The vulnerable component ElementSearchController was introduced in Craft CMS 5.x and does not exist in version 4.x. The target repository is running version 4.18.7, which predates the introduction of this controller. The only controller in version 4.18.7 that processes user query criteria (ElementIndexesController) already contains the proper defense mechanism (ElementHelper::cleanseQueryCriteria()) that was added for CVE-2026-25495. No alternative code path exists in version 4.18.7 that exhibits the same SQL injection vulnerability pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-31859", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:7bd6b5ce-37f7-51c8-91cc-87b51cb8f33b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-31859 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The vulnerability (XSS via javascript: URLs bypassing strip_tags()) was fixed by upstream vendor commit cc9921c14897ee2b592a431c2356af8a04ce4cfe, which added URL scheme validation before strip_tags() in src/web/User.php::setReturnUrl(). This fix was already present in upstream version 4.18.7 (released 2026-08-18) when TuxCare onboarded it (commit 4a22c9d3d...", "justification": "code_not_present" } }, { "id": "CVE-2026-32262", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:b1044b13-dc00-5ad7-ab0c-c4b3014d3033", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32262 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (craftcms/cms 4.18.7) is not affected by CVE-2026-32262. The vulnerability (path traversal via unsanitized targetFilename parameter in AssetsController->replaceFile() allowing arbitrary file deletion) was fixed by upstream vendor Pixel & Tonic in version 4.17.5 (commit c997efbe4c, Feb 16 2026). The target version 4.18.7 inherits this fix from upstream. The validation code rejecting f...", "justification": "code_not_present" } }, { "id": "CVE-2026-32263", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:a550a20f-89f4-5b76-bfcc-24c60d68facc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32263 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-32263 affects Craft CMS versions 5.6.0 to before 5.9.11, specifically in src/controllers/EntryTypesController.php. The target version 4.18.7 is not affected because: (1) EntryTypesController.php does not exist in version 4.x; (2) Entry type management in 4.x is handled by SectionsController.php which does not use parse_str; (3) All 4 instances of parse_str in version 4.18.7 controllers (FieldsController.php and ElementIndexesController.php) are protected with Component::cleanseConfig() before passing data to Craft::configure(). The vulnerable code pattern described in the CVE does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-32264", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:b5157877-39ea-5843-a491-228d887b08d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32264 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32264 fix dfec46362fcb by brandon@pixelandtonic.com (2026-02-16) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2026-32267", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:9fbfcfc9-0d22-582c-a03a-9cd86eff8e8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-32267 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-32267 fix 6301e217c5f1 by brandon@pixelandtonic.com (2026-02-18) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2026-33051", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:1c2e88da-589f-5d78-a819-78955dc26046", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33051 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS 4.18.7 is not affected by CVE-2026-33051. The CVE describes an XSS vulnerability specific to versions 5.9.0-beta.1 through 5.9.10 where the creator's fullName is rendered as raw HTML due to Template::raw() combined with Craft::t() in the revision/draft context menu. While the target version 4.18.7 does display creator names in the revision menu (src/templates/_includes/revisionmenu.tw...", "justification": "code_not_present" } }, { "id": "CVE-2026-33157", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:b5c95fd6-b776-59f3-bc3f-ec472532914a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33157 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Version 4.18.7 is NOT affected by CVE-2026-33157. The vulnerability exists in Craft CMS 5.6.0-5.9.12 where a NEW code path (fieldLayouts parameter in ElementIndexesController::actionFilterHud) bypasses existing sanitization. This specific code path does NOT exist in version 4.x. Version 4.18.7 only processes conditionConfig in actionFilterHud(), which is properly sanitized via Component::cleanseConfig() at line 421. The setFieldLayouts() method and fieldLayouts parameter handling were introduced in version 5.x and are completely absent from version 4.18.7's codebase.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-33158", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:d8e5308a-03ae-5a01-9743-5cbfa5b7ff31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33158 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-33158 is NOT present in Craft CMS 4.18.7. The vulnerability described an authorization bypass in the assets/edit-image endpoint allowing low-privileged users to read private asset content. The upstream vendor (Pixel & Tonic) fixed this in version 4.17.8 (commit e674bbbd30, Feb 25 2026) by adding requireVolumePermissionByAsset() and requirePeerVolumePermissionByAsset() checks. Version 4...", "justification": "code_not_present" } }, { "id": "CVE-2026-33159", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:7bc301e1-b998-516a-8961-55c70597a14a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33159 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) contains the complete fix for CVE-2026-33159. The upstream vendor (Pixel & Tonic) fixed the vulnerability in commit 7f0ead833f (2026-02-25), included it in their 4.18.7 release (2026-08-18), and TuxCare onboarded that pre-fixed version (2026-09-07). The vulnerable pattern\u2014missing authentication/authorization on ConfigSyncController\u2014is not present at HEAD. Verdict: ...", "justification": "code_not_present" } }, { "id": "CVE-2026-33160", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:a665b314-d629-56f4-8faa-52522d6674fa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33160 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-33160 fix 83fd398c12a3 by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2026-33161", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:e91144ff-5377-542d-94a0-664ac4e4d510", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33161 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target repository (Craft CMS 4.18.7) contains the upstream vendor's fix for the asset information disclosure vulnerability. The CVE describes an authorization bypass where the assets/image-editor endpoint (actionImageEditor method) returns focalPoint and other editor metadata without validating user permissions. The fix (commit 1f91f9b7aa, GHSA-vgjg-248p-rfm2) added requireVolumePermissionB...", "justification": "code_not_present" } }, { "id": "CVE-2026-33162", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:53fe4658-0630-594c-9b9d-553a8ad97911", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33162 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Craft CMS v4.18.7 is not affected by CVE-2026-33162. The vulnerability affects the `/actions/entries/move-to-section` endpoint and Entry::canMove() authorization method, which were introduced in Craft CMS v5.x. Version 4.18.7 does not have the move-entries-between-sections feature at all. The GraphQL resolver explicitly prevents section changes with the error \"Impossible to change the section o...", "justification": "code_not_present" } }, { "id": "CVE-2026-41129", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:3809dc1d-7b9a-5b0f-932f-55434cc69060", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41129 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 CVE-2026-41129 (SSRF via unvalidated URL scheme in GraphQL asset upload) is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit d20aecfaa0 (March 4, 2026) by adding scheme validation that blocks non-HTTP/HTTPS protocols (gopher, file, ftp, etc.). This fix was later refactored into the craftcms/url-validator library (commit 26268c0210, Jun...", "justification": "code_not_present" } }, { "id": "CVE-2026-41130", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:1c2bf22e-226c-5e92-8163-07564e608a96", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41130 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 The target (Craft CMS 4.18.7) is not affected by CVE-2026-41130. The SSRF vulnerability in the resource-js endpoint was fixed by upstream vendor (Pixel & Tonic) in commit ebe7e85f1c, which is present in the target. The vulnerable code that made HTTP requests via Guzzle client has been replaced with local filesystem serving using App::resourcePathByUri() with path traversal protection. Additiona...", "justification": "code_not_present" } }, { "id": "CVE-2026-55790", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:a663cca2-179e-587c-b676-89e486179a92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-55790 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. CVE-2026-55790 (GHSA-24x4-j6x9-rfw5): The XSS vulnerability in the CraftSupport widget is NOT present in target version 4.18.7. The upstream vendor (Pixel & Tonic) fixed this vulnerability in commit 6bbb66038a (May 2026) by adding HTML escaping via Craft.escapeHtml() and using jQuery's text: option for error messages. This fix was included in upstream's 4.18.7 release (August 2026), which TuxCare subsequently adopted for ELS support (September 2026). TuxCare did not backport this specific fix; they inherited an already-fixed upstream release. Both defense mechanisms from the patch are present and correctly implemented at lines 382 and 555-557 of CraftSupportWidget.js.", "justification": "code_not_present" } }, { "id": "CVE-2026-55793", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:24f769c8-0e3c-5bbc-8266-cec920d7642e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55793 is fixed in version 4.18.7-p1+tuxcare of craftcms/cms." } }, { "id": "CVE-2026-56381", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:9acf0432-9664-5289-9d6f-0c39557b9541", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56381 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is not affected. The CVE describes a vulnerability in version 5.0.0-RC1+, but analysis of 4.18.7 code shows user group names are protected by Twig's default HTML auto-escaping and Vue's text interpolation escaping. All rendering paths include runtime defenses that transform script content before display, preventing execution in administrators' browsers.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-56382", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:397403bb-eb32-585b-ac3e-1773ffee39e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56382 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target version 4.18.7 is not affected by CVE-2026-56382. The vulnerable method `actionRenderCardPreview()` from the v5.x patch does not exist in v4.18.7's codebase. The CVE affects Craft CMS versions >= 5.5.0 and <= 5.9.13, while this target is v4.18.7. Although TuxCare backported this CVE to v3.9.15 (fixing a different vulnerable method `actionRenderLayoutElementSelector()`), v4.18.7 contains neither the v5.x vulnerable method nor the v3.x vulnerable method. The methods that do exist in v4.18.7 and handle layout configurations (`actionApplyLayoutTabSettings()`, `actionApplyLayoutElementSettings()`) properly sanitize all config parameters via `Component::cleanseConfig()` before passing them to layout creation functions.", "justification": "code_not_present" } }, { "id": "CVE-2026-56383", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:29afab1a-1617-5319-aafc-8d0502e46d65", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56383 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 is NOT AFFECTED. The upstream vendor fix (commit 7b372de262b8) is present in HEAD, applying HTML encoding to heading-type cell values before rendering. The fix was authored by brandon@pixelandtonic.com (Craft CMS upstream) and shipped in version 4.16.19. TuxCare onboarded version 4.18.7 (released 2026-08-18) which already contained this fix. No TuxCare attribution signals ...", "justification": "code_not_present" } }, { "id": "CVE-2026-56384", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:2da4289d-97cb-5720-a1de-a21fc70f48e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56384 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 fixed upstream before 4.18.7: CVE-2026-56384 fix ed56049c9d3f by brandon@pixelandtonic.com (2026-02-25) is an ancestor of tuxcare-current/4.18.7; no TuxCare backport for this CVE on the branch \u2014 the CloudLinux commit VC credited is the onboarding merge (bashebr@cloudlinux.com, 2026-09-07). Manual re-label of VC verdict already_fixed\u2192not_affected after git verification, 2026-09-11.", "justification": "code_not_present" } }, { "id": "CVE-2026-56385", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:6c03bf76-6e1a-5fc5-a30c-daf23a0fe2aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56385 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. not_affected \u2014 Target version 4.18.7 contains the upstream vendor's authorization fix for CVE-2026-56385. The vulnerability (authorization bypass in assets/preview-file endpoint) was fixed by Pixel & Tonic in commit d30df31122 (Feb 2026) which added requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to actionPreviewFile(). This fix was included in upstream Craft CMS 4.17.8 and 4.18.7...", "justification": "code_not_present" } }, { "id": "CVE-2026-56394", "affects": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ], "bom-ref": "urn:uuid:2f7c70a4-6c14-5af4-b8aa-645af6f2ced9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-56394 does not affect version 4.18.7-p1+tuxcare of craftcms/cms. Target Craft CMS 4.18.7 is not affected by CVE-2026-56394 (GHSA-472v-j2g4-g9h2). The path traversal vulnerability in the assets/icon endpoint has been fixed by upstream vendor commit 30f5f1a8d6 (authored by brandon@pixelandtonic.com), which added regex validation to reject extension parameters containing traversal sequences. The fix validates extensions with /^\\w+$/ before filesystem operations, preventing the attack chain described in the CVE. TuxCare adopted this fix when onboarding version 4.18.7 to ELS support.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:composer/craftcms/cms@4.18.7-p1+tuxcare" } ] }