CVE-2021-23260: Craftercms Crafter CMS

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.

Affected products

• Craftercms Crafter CMS: from 3.1.0, before 3.1.12 (fixed in 3.1.12)

Published 2021-12-02. Last modified 2026-06-17.