Security Digest · page 1 of 3
Critical Composer (PHP) advisories
244 critical advisories for Composer (PHP) packages since October 2023, newest first. Check your project with composer audit.
- Contao: Cross-site scripting in the comments bundle CVE-2026-107845 CVSS 9.3 Critical
contao/comments-bundle>= 4.0.0, < 5.3.50 → fixed in 5.3.50;contao/comments-bundle>= 5.4.0-RC1, < 5.7.12 → fixed in 5.7.12 - FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider CVE-2026-92161 CVSS 9.8 Critical
fof/oauth< 1.7.4 → fixed in 1.7.4;fof/oauth>= 2.0.0-beta.1, < 2.0.0-beta.4 → fixed in 2.0.0-beta.4 - CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVE-2026-79752 CVSS 9.2 Critical
cakephp/database>= 4.6.0, < 4.6.5 → fixed in 4.6.5;cakephp/database>= 5.0.0, < 5.1.9 → fixed in 5.1.9;cakephp/database>= 5.2.0, < 5.2.14 → fixed in 5.2.14; +7 more packages - Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS CVE-2026-75828 CVSS 9.3 Critical
getgrav/grav<= 2.0.14 → fixed in 2.0.15 - Chamilo LMS CStudio upload flow allows unauthenticated remote code execution CVE-2026-45140 CVSS 9.8 Critical
chamilo/chamilo-lms<= 2.0.0 → fixed in 2.0.1 - Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write CVE-2026-75827 CVSS 9.3 Critical
getgrav/grav<= 2.0.14 → fixed in 2.0.15 - Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections CVE-2026-84372 CVSS 9.8 Critical
predis/predis>= 3.0.0-RC1, < 3.3.0 → fixed in 3.3.0 - CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVE-2026-77635 CVSS 9.2 Critical
cakephp/cakephp>= 5.3.0, < 5.3.7 → fixed in 5.3.7;cakephp/cakephp>= 5.2.0, < 5.2.15 → fixed in 5.2.15;cakephp/cakephp>= 5.1.0, < 5.1.10 → fixed in 5.1.10; +3 more packages - Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) CVE-2026-55220 CVSS 9.3 Critical
pimcore/pimcore>= 2026.1.0, <= 2026.1.5 → fixed in 2026.1.6;pimcore/pimcore<= 12.3.9 → fixed in 12.3.10 - Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55634 CVSS 9.9 Critical
pimcore/pimcore<= 12.3.9 → fixed in 12.3.10;pimcore/pimcore>= 2026.1.0, <= 2026.1.5 → fixed in 2026.1.6 - Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) CVE-2026-59989 CVSS 9.2 Critical
phalcon/cphalcon<= 5.15.0 → fixed in 5.16.0 - jmespath.php has CompilerRuntime code injection via unescaped function names CVE-2026-54133 CVSS 9.8 Critical
mtdowling/jmespath.php< 2.9.1 → fixed in 2.9.1 - Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints CVE-2026-62988 CVSS 9.0 Critical
froxlor/froxlor< 2.3.8 → fixed in 2.3.8 - Craft CMS: Passkey login accepts replayed WebAuthn assertions GHSA-wg23-69c2-gjc8 CVSS 9.1 Critical
craftcms/cms>= 5.0.0-RC1, < 5.10.5 → fixed in 5.10.5 - CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules CVE-2026-63223 CVSS 9.8 Critical
codeigniter4/framework< 4.7.4 → fixed in 4.7.4 - CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions CVE-2026-63221 CVSS 9.4 Critical
codeigniter4/framework>= 4.3.0, < 4.7.4 → fixed in 4.7.4 - Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. CVE-2026-54588 CVSS 9.6 Critical
poweradmin/poweradmin< 4.2.4 → fixed in 4.2.4;poweradmin/poweradmin>= 4.3.0, < 4.3.3 → fixed in 4.3.3 - Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password GHSA-f25v-x6vr-962g CVSS 10.0 Critical
pheditor/pheditor< 2.0.8 → fixed in 2.0.8 - Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise CVE-2026-55579 CVSS 9.8 Critical
pheditor/pheditor>= 2.0.1, < 2.0.6 → fixed in 2.0.6 - MantisBT: Reflected XSS in admin/install.php via unescaped printf CVE-2026-52881 CVSS 9.2 Critical
mantisbt/mantisbt<= 2.28.3 → fixed in 2.28.4 - MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator CVE-2026-47156 CVSS 9.3 Critical
mantisbt/mantisbt<= 2.28.3 → fixed in 2.28.4 - MantisBT: Reflected XSS in admin/install.php CVE-2026-52847 CVSS 9.2 Critical
mantisbt/mantisbt<= 2.28.3 → fixed in 2.28.4 - FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE GHSA-hgjx-r89m-m7v4 CVSS 9.9 Critical
facturascripts/facturascripts>= 2025, <= 2026.2 → no fix listed - FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn` CVE-2026-45262 CVSS 9.9 Critical
facturascripts/facturascripts<= 2026.1 → no fix listed - Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover CVE-2026-52824 CVSS 9.1 Critical
kimai/kimai<= 2.57.0 → fixed in 2.58.0 - FacturaScripts: Account takeover of any 2FA-enabled user CVE-2026-47677 CVSS 9.3 Critical
facturascripts/facturascripts<= 2026.2 → fixed in 2026.3 - prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE CVE-2026-54159 CVSS 10.0 Critical
prestashop/ps_facetedsearch>= 3.0.0, < 4.0.4 → fixed in 4.0.4 - YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service CVE-2026-52778 CVSS 9.8 Critical
yeswiki/yeswiki< 4.6.6 → fixed in 4.6.6 - YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize CVE-2026-52777 CVSS 9.4 Critical
yeswiki/yeswiki< 4.6.6 → fixed in 4.6.6 - YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action CVE-2026-52766 CVSS 9.1 Critical
yeswiki/yeswiki< 4.6.6 → fixed in 4.6.6 - EGroupware has a Remote Code Execution Vulnerability CVE-2026-27823 CVSS 9.3 Critical
egroupware/egroupware>= 26.0.20251208, < 26.2.20260224 → fixed in 26.2.20260224;egroupware/egroupware< 23.1.20260224 → fixed in 23.1.20260224 - Formie Hidden field defaults vulnerable to Server-Side Template Injection CVE-2026-52889 CVSS 9.8 Critical
verbb/formie< 3.1.27 → fixed in 3.1.27 - Mautic has Server-Side Template Injection (SSTI) in Theme Templates CVE-2026-9558 CVSS 9.9 Critical
mautic/core>= 1.3.0, < 4.4.13 → no fix listed;mautic/core>= 5.0.0, < 5.2.11 → fixed in 5.2.11;mautic/core>= 6.0.0, < 6.0.9 → fixed in 6.0.9; +1 more packages - Mautic vulnerable to Path Traversal via Campaign Import CVE-2026-9559 CVSS 9.9 Critical
mautic/core>= 7.0.0, < 7.1.2 → fixed in 7.1.2 - Paymenter vulnerable to Remote Code Execution via public file uploads CVE-2025-58048 CVSS 9.9 Critical
paymenter/paymenter< 1.2.11 → fixed in 1.2.11 - Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs CVE-2026-55791 CVSS 9.2 Critical
craftcms/cms>= 5.0.0-RC1, < 5.10 → fixed in 5.10;craftcms/cms>= 4.0.0-RC1, < 4.18 → fixed in 4.18 - Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header CVE-2026-54003 CVSS 9.1 Critical
getkirby/cms<= 4.9.3 → fixed in 4.9.4;getkirby/cms>= 5.0.0-alpha.1, <= 5.4.3 → fixed in 5.4.4 - Cotonti: Cross-Site Request Forgery in the administration rights handler CVE-2026-55742 CVSS 9.4 Critical
cotonti/cotonti<= 1.0.0 → no fix listed - shlink has a Server-Side Request Forgery issue CVE-2026-50887 CVSS 9.1 Critical
shlinkio/shlink<= 5.0.1 → no fix listed - Project Firefly III has incorrect access control in the webhook management component CVE-2026-50886 CVSS 9.1 Critical
grumpydictator/firefly-iii<= 6.5.9 → no fix listed - CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule CVE-2026-48062 CVSS 9.8 Critical
codeigniter4/framework< 4.7.2 → fixed in 4.7.3 - Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter CVE-2026-48030 CVSS 9.9 Critical
pheditor/pheditor>= 2.0.1, <= 2.0.3 → fixed in 2.0.4 - PHPSpreadsheet has a patch bypass for CVE-2026-34084 CVE-2026-45034 CVSS 9.2 Critical
phpoffice/phpspreadsheet<= 1.30.4 → fixed in 1.30.5 - Shopper: Authorization bypass and RBAC privilege escalation in team settings CVE-2026-47744 CVSS 9.9 Critical
shopper/framework< 2.8.0 → fixed in 2.8.0 - WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin CVE-2026-54458 CVSS 9.6 Critical
WWBN/AVideo<= 29.0 → no fix listed - Dolibarr ERP CRM contains a remote code evaluation vulnerability CVE-2018-25357 CVSS 9.3 Critical
dolibarr/dolibarr>= 7.0.0, <= 7.0.3 → fixed in 7.0.4;dolibarr/dolibarr< 6.0.8 → fixed in 6.0.8 - YesWiki: Unauthenticated SQL Injection CVE-2026-46670 CVSS 9.8 Critical
yeswiki/yeswiki< 4.6.4 → fixed in 4.6.4 - Twig: PHP code injection via `{% use %}` template name CVE-2026-46633 CVSS 9.3 Critical
twig/twig< 3.26.0 → fixed in 3.26.0 - Concrete CMS Vulnerable to Relative Path Traversal CVE-2026-8134 CVSS 9.4 Critical
concrete5/concrete5< 9.5.1 → fixed in 9.5.1 - Drupal Core has a SQL Injection issue CVE-2026-9082 CVSS 9.8 Critical
drupal/core>= 8.9.0, < 10.4.10 → fixed in 10.4.10;drupal/core>= 10.5.0, < 10.5.10 → fixed in 10.5.10;drupal/core>= 10.6.0, < 10.6.9 → fixed in 10.6.9; +3 more packages - TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) CVE-2026-46725 CVSS 9.2 Critical
mmc/ceselector>= 6.0.0, < 6.0.1 → fixed in 6.0.1;mmc/ceselector>= 5.0.0, < 5.0.1 → fixed in 5.0.1;mmc/ceselector>= 4.0.0, < 4.0.2 → fixed in 4.0.2; +1 more packages - Formie: Pre-authenticated server-side template injection in Hidden fields CVE-2026-45697 CVSS 9.8 Critical
verbb/formie>= 3.0.0-beta.1, < 3.1.24 → fixed in 3.1.24;verbb/formie< 2.2.20 → fixed in 2.2.20 - torrentpier has PHP Serialize Injections GHSA-h29g-c9cx-c73q
torrentpier/torrentpier<= 2.4.3 → fixed in 2.4.4 - Snipe-IT has insecure permissions in file uploads CVE-2026-37709 CVSS 9.8 Critical
snipe/snipe-it< 8.4.1 → fixed in 8.4.1 - PrestaShop has a stored XSS executable in customer service view CVE-2026-44212 CVSS 9.3 Critical
prestashop/prestashop< 8.2.6 → fixed in 8.2.6;prestashop/prestashop>= 9.0.0, < 9.1.1 → fixed in 9.1.1 - Compromised tag of intercom-php published via GitHub GHSA-gr3r-crp5-qrrm CVSS 9.3 Critical
intercom/intercom-php= 5.0.2 → no fix listed - phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id CVE-2026-45010 CVSS 9.1 Critical
thorsten/phpmyfaq<= 4.1.1 → fixed in 4.1.2;phpmyfaq/phpmyfaq<= 4.1.1 → fixed in 4.1.2 - Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules CVE-2026-44262 CVSS 9.4 Critical
dedoc/scramble>= 0.13.2, <= 0.13.21 → fixed in 0.13.22 - phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha CVE-2026-46364 CVSS 9.8 Critical
thorsten/phpmyfaq<= 4.1.1 → fixed in 4.1.2;phpmyfaq/phpmyfaq<= 4.1.1 → fixed in 4.1.2 - Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature CVE-2026-42607 CVSS 9.1 Critical
getgrav/grav< 2.0.0-beta.2 → fixed in 2.0.0-beta.2 - Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass GHSA-vj3m-2g9h-vm4p
getgrav/grav< 2.0.0-beta.2 → fixed in 2.0.0-beta.2 - Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access CVE-2026-42613 CVSS 9.4 Critical
getgrav/grav< 2.0.0-beta.2 → fixed in 2.0.0-beta.2 - Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs CVE-2026-42155 CVSS 9.3 Critical
openmage/magento-lts<= 20.17.0 → fixed in 20.18.0 - phpVMS has an /importer authorization bypass causing full database wipe CVE-2026-42569 CVSS 9.4 Critical
nabeel/phpvms< 7.0.6 → fixed in 7.0.6 - PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled CVE-2026-34084 CVSS 9.2 Critical
phpoffice/phpspreadsheet>= 4.0.0, <= 5.5.0 → fixed in 5.6.0;phpoffice/phpspreadsheet>= 3.3.0, <= 3.10.3 → fixed in 3.10.4;phpoffice/phpspreadsheet>= 2.2.0, <= 2.4.3 → fixed in 2.4.4; +2 more packages - Cockpit is vulnerable to arbitrary code execution CVE-2026-38992 CVSS 9.8 Critical
cockpit-hq/cockpit< 2.14.0 → fixed in 2.14.0 - CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE CVE-2026-41203 CVSS 9.4 Critical
ci4-cms-erp/ci4ms< 0.31.5.0 → fixed in 0.31.5.0 - CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE CVE-2026-41202 CVSS 9.4 Critical
ci4-cms-erp/ci4ms< 0.31.5.0 → fixed in 0.31.5.0 - Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVE-2026-23500 CVSS 9.4 Critical
dolibarr/dolibarr<= 22.0.4 → no fix listed - goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files CVE-2026-31843 CVSS 10.0 Critical
goodoneuz/pay-uz<= 2.2.24 → fixed in 3.0.0 - Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution CVE-2026-41228 CVSS 9.9 Critical
froxlor/froxlor<= 2.3.5 → fixed in 2.3.6 - Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) CVE-2026-41229 CVSS 9.1 Critical
froxlor/froxlor<= 2.3.5 → fixed in 2.3.6 - WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks CVE-2026-40911 CVSS 10.0 Critical
wwbn/avideo<= 29.0 → no fix listed - CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via… CVE-2026-35035 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.31.1.0 → fixed in 0.31.2.0 - CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34989 CVSS 9.4 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 31.0.0.0 - CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34565 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34568 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34560 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34567 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via… CVE-2026-34561 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34564 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34569 CVSS 9.9 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account… CVE-2026-34571 CVSS 9.9 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS CVE-2026-34563 CVSS 9.9 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34566 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34559 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34558 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS CVE-2026-34557 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) CVE-2026-21861 CVSS 9.1 Critical
baserproject/basercms<= 5.2.2 → fixed in 5.2.3 - baserCMS Update Functionality Vulnerable to OS Command Injection CVE-2026-30877 CVSS 9.1 Critical
baserproject/basercms<= 5.2.2 → fixed in 5.2.3 - baserCMS has OS command injection vulnerability in installer CVE-2026-30880 CVSS 9.2 Critical
baserproject/basercms<= 5.2.2 → fixed in 5.2.3 - ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation… CVE-2026-27599 CVSS 9.1 Critical
ci4-cms-erp/ci4ms<= 0.28.6.0 → fixed in 0.31.0.0 - AVideo has Plaintext Video Password Storage CVE-2026-33867 CVSS 9.1 Critical
wwbn/avideo<= 26.0 → no fix listed - AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVE-2026-33716 CVSS 9.4 Critical
wwbn/avideo<= 26.0 → no fix listed - MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL CVE-2026-30849 CVSS 9.3 Critical
mantisbt/mantisbt< 2.28.1 → fixed in 2.28.1 - AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection CVE-2026-33478 CVSS 10.0 Critical
wwbn/avideo<= 26.0 → no fix listed - AVideo has Unauthenticated SSRF via plugin/Live/test.php CVE-2026-33502 CVSS 9.3 Critical
wwbn/avideo<= 26.0 → no fix listed - AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVE-2026-33352 CVSS 9.8 Critical
wwbn/avideo<= 26.0 → no fix listed - AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass CVE-2026-33351 CVSS 9.1 Critical
wwbn/avideo<= 26.0 → no fix listed - Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVE-2026-32817 CVSS 9.1 Critical
admidio/admidio>= 5.0.0, <= 5.0.6 → fixed in 5.0.7