CVE-2025-55043

MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerability enables complete data exfiltration including user accounts, password hashes, form submissions, email lists, plugins, and site content without administrator knowledge. This CSRF vulnerability enables complete data exfiltration from MuraCMS installations without requiring authentication. Attackers can force administrators to unknowingly create site bundles containing sensitive data, which are saved to publicly accessible web directories. The attack executes silently, leaving administrators unaware that confidential information has been compromised and is available for unauthorized download.

• CWE-352

• https://docs.murasoftware.com/v10/release-notes/#section-version-1014Release Notes
• https://www.murasoftware.comProduct

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55037Improper neutralization of special elements used in an OS co…9.8
• CVE-2025-55038An authorization bypass vulnerability has been discovered in…7.6
• CVE-2025-55039This issue affects Apache Spark versions before 3.4.4, 3.5.…6.5
• CVE-2025-5504A vulnerability has been found in TOTOLINK X2000R 1.0.0-B202…6.3
• CVE-2025-55040The import form CSRF vulnerability in MuraCMS through 10.1.1…8.8
• CVE-2025-55041MuraCMS through 10.1.10 contains a CSRF vulnerability in the…8
• CVE-2025-55044The Trash Restore CSRF vulnerability in MuraCMS through 10.1…8.8
• CVE-2025-55045The update address CSRF vulnerability in MuraCMS through 10.…7.1
• CVE-2025-55046MuraCMS through 10.1.10 contains a CSRF vulnerability that a…8.1
• CVE-2025-55047CWE-798 Use of Hard-coded Credentials8.4
• CVE-2025-55048Multiple CWE-789.8
• CVE-2025-55049Use of Default Cryptographic Key (CWE-1394)9.1