CVE-2022-40634: Craftercms Crafter CMS

High severity, CVSS 7.2. EPSS: 1.6% chance of exploitation in the next 30 days.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

Affected products

• Craftercms Crafter CMS: from 3.1.0, before 3.1.23 (fixed in 3.1.23)

Published 2022-09-13. Last modified 2026-06-17.