Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M

CVE-2024-32641Masa CMS Vulnerable to Pre-Auth RCE via JSON API

Critical 9.8

In plain English

A critical-severity code injection in MasaCMS from MasaCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 13.1% (higher than 96% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)13.1%top 3.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

Affected products (as reported)

Vendor	Product	Versions
MasaCMS	MasaCMS	>= 7.4.0, < 7.4.6>= 7.3.0, < 7.3.13< 7.2.8

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-cj9g-v5mq-qrjm x_refsource_CONFIRM
https://github.com/MasaCMS/MasaCMS/commit/fb27f822fe426496af71205fa35208e58823fcf6 x_refsource_MISC