Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a forged request that restores deleted items from the trash and places them at an attacker-controlled location in the site structure through the parentid parameter. This can restore previously deleted malicious or outdated content, expose sensitive documents by moving them into publicly accessible locations, and disrupt site structure or content integrity. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, restrict access to the administrative backend, use browser isolation for administrative sessions, and regularly empty the trash to reduce the amount of content available for unauthorized restoration.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-40325 Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens… https://www.cve.org/CVERecord?id=CVE-2026-40325
Post summary
The text announces CVE-2026-40325, describing a CSRF validation flaw in Masa CMS without providing PoC, exploit code, or patch information.
CVE-2026-40325 Cross-Site Request Forgery in Masa CMS Content Restoration via Improper ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40325 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text announces CVE‑2026‑40325, a CSRF vulnerability in Masa CMS’s content restoration feature, linking to a vulnerability database and alert, but provides no PoC, exploit, patch, or active exploitation details.