CVE-2021-27903: Craft CMS

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).

Affected products

• Craft CMS Craft CMS: before 3.6.7 (fixed in 3.6.7)

Published 2021-06-30. Last modified 2026-06-17.