CVE-2023-33197: Craft CMS

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

Affected products

• Craft CMS Craft CMS: before 4.4.6 (fixed in 4.4.6)

Published 2023-05-26. Last modified 2026-06-17.