PT-2026-26081 · Mura Cms · Mura Cms

Published 2026-03-18 · Updated 2026-03-18 · CVE-2025-55043

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description MuraCMS installations are susceptible to a Cross-Site Request Forgery (CSRF) issue within the bundle creation functionality, specifically the csettings.cfc createBundle method. This allows unauthenticated attackers to compel administrators to generate and store site bundles—containing sensitive data—in publicly accessible directories. The compromised data includes user accounts, password hashes, form submissions, email lists, plugins, and site content. The attack operates without the administrator’s knowledge, enabling complete data exfiltration. The createBundle method is vulnerable to exploitation.

Recommendations Versions prior to 10.1.10 should be updated.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-55043

Affected Products

Mura Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-55043 · Security Note
• https://murasoftware.com · Note
• https://twitter.com/CVEnew/status/2034365324162982178 · Twitter Post
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Note