PT-2026-26084 · Mura Cms · Mura Cms

Published 2026-03-18 · Updated 2026-03-18 · CVE-2025-55046

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MuraCMS versions through 10.1.10

Description MuraCMS through version 10.1.10 is affected by a Cross-Site Request Forgery (CSRF) issue. An attacker can exploit this to permanently delete all content in the trash system. The cTrash.empty function does not validate CSRF tokens, allowing a malicious website to forge requests. When an authenticated administrator visits a crafted webpage, the browser automatically submits a form that empties the trash system without confirmation. This can lead to catastrophic data loss within the MuraCMS system.

Recommendations Versions prior to 10.1.10 should be updated.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-55046

Affected Products

Mura Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-55046 · Security Note
• https://twitter.com/CVEnew/status/2034365327308628266 · Twitter Post
• https://docs.murasoftware.com/v10/release-notes/#section-version-1014 · Note
• https://murasoftware.com · Note