CVE-2025-55046
CSRF in MuraCMS Trash Function Causes Permanent Data Loss
Publication date: 2026-03-18
Last updated on: 2026-03-20
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| murasoftware | mura_cms | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in MuraCMS through version 10.1.10 and is a Cross-Site Request Forgery (CSRF) issue. It allows attackers to permanently delete all content stored in the trash system without the administrator's consent. The vulnerable function, cTrash.empty, does not validate CSRF tokens, which means a malicious website can trick an authenticated administrator into submitting a hidden form that empties the trash system automatically when they visit the malicious page.
How can this vulnerability impact me? :
The impact of this vulnerability is potentially catastrophic data loss within the MuraCMS system. An attacker can cause all deleted content in the trash system to be permanently erased without any confirmation or user consent, which could result in loss of important data that might have been intended for recovery.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this CSRF vulnerability in MuraCMS, immediate steps should focus on preventing unauthorized requests that empty the trash system.
- Restrict administrator access to trusted networks and devices to reduce exposure to malicious websites.
- Advise administrators to avoid visiting untrusted or suspicious websites while logged into the MuraCMS administrative interface.
- Implement or enforce CSRF token validation in the cTrash.empty function to ensure requests are legitimate.
- Regularly back up all content, including trashed items, to enable recovery in case of accidental or malicious deletion.