PT-2026-26079 · Mura Cms · Mura Cms

Published 2026-03-18 · Updated 2026-03-19 · CVE-2025-55040

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description A Cross-Site Request Forgery (CSRF) issue exists in the import form functionality of MuraCMS. The cForm.importform function does not validate CSRF tokens, allowing attackers to upload and install malicious form definitions. An attacker can forge file upload requests, which are executed when an authenticated administrator visits a malicious webpage. Exploitation involves the administrator selecting a malicious ZIP file containing form definitions, potentially leading to the installation of data collection forms designed to steal sensitive user information. The cForm.importform function is the component susceptible to this issue.

Recommendations MuraCMS versions through 10.1.10 should be updated to a newer, secure version to address this vulnerability. As a temporary workaround, consider restricting access to the import form functionality to trusted administrators only.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-55040

Affected Products

Mura Cms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-55040 · Security Note
• https://murasoftware.com · Note
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Note
• https://twitter.com/CVEnew/status/2034365322275565830 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034389329385230604 · Twitter Post
• https://twitter.com/NewsNerdie/status/2034691844932546696 · Twitter Post