PT-2026-57807 · Mura · Cms

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-12257

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/ api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-12257

Affected Products

Cms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-12257 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/remote-code-execution-mura-softwares-cms · Note