CVE-2023-40035 - CVE House
Back to Database
Status published High CVE-2023-40035

Craft CMS vulnerable to Remote Code Execution via validatePath bypass

Vulnerability Description

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40035

Credits & Attribution

No credits recorded in the NVD database.

References

More from craftcms

View All →
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
High 7
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High 8.6
CVE-2025-68454
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
Medium 5.2
CVE-2025-68437
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
Medium 5
CVE-2025-68436
Craft CMS vulnerable to potential information disclosure via unchecked asset relocation
Medium 4.9

Affected Vendor

Affected Software

cms
Vulnerable Versions:
>= 4.0.0-RC1, < 4.4.15, >= 3.0.0, < 3.8.15

Timeline

Official Publish: August 23rd, 2023
Last Modified: October 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-74

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1213 Data from Information Repositories
Collection