CVE-2026-40325 Details
Description
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted items from the trash and places them at an attacker-controlled location in the site structure through the parentid parameter. This can restore previously deleted malicious or outdated content, expose sensitive documents by moving them into publicly accessible locations, and disrupt site structure or content integrity. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.
A cross-site request forgery (CSRF) vulnerability has been identified in Masa CMS versions 7.5.2 and earlier, specifically within the content restoration feature. The issue arises because the 'cTrash.restore' function does not adequately validate anti-CSRF tokens, allowing an attacker to manipulate a logged-in administrator into submitting a fake request that restores deleted items from the trash. These items can be placed in an attacker-controlled location on the site using the 'parentid' parameter. This vulnerability could be exploited to reinstate harmful or outdated content, expose sensitive documents by relocating them to public areas, and disrupt the overall site structure or content integrity.
Users are advised to upgrade to Masa CMS versions 7.2.10, 7.3.15, 7.4.10, or 7.5.3. If an immediate upgrade is not possible, administrators can log out of the Masa CMS admin interface when not in use, perform administrative tasks in a private browsing window, configure a Web Application Firewall to block suspicious requests to the 'cTrash.cfc' endpoint, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 6, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-3mpf-gq73-crxf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Masa CMS | <= 7.5.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |