CVE-2024-32641 Masa CMS Vulnerable to Pre-Auth RCE via JSON API
Unauthenticated attackers can execute arbitrary code in Masa CMS via the JSON API criteria parameter, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-32641?
CVE-2024-32641 is a critical code injection vulnerability in MasaCMS, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.
Weakness: CWE-94
Which versions are affected by CVE-2024-32641?
It affects 1 product.
Products include Masacms Masacms.
How do I fix CVE-2024-32641?
No fix has been published for CVE-2024-32641 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-32641 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32641 exists.
Other vulnerabilities in MasaCMS
- CVE-2022-47002 Auth bypass in n/a
- CVE-2024-32642 Host header poisoning allows account takeover via password reset email
- CVE-2025-66492 Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter
- CVE-2024-32643 Masa CMS vulnerable to authentication bypass with /tag/
- CVE-2021-42183 Path traversal in n/a
Sources
Also known as GHSA-cj9g-v5mq-qrjm.