Vulnerability Description
Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-12257?
CVE-2026-12257 is a documented vulnerability. Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter...
How severe is CVE-2026-12257?
CVSS scoring is not yet available for CVE-2026-12257. Check NVD for updates.
Is there a patch for CVE-2026-12257?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.