CVE-2025-55040
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker-controlled forms when an authenticated administrator visits a crafted webpage. Full exploitation of this vulnerability would require the victim to select a malicious ZIP file containing form definitions, which can be automatically generated by the exploit page and used to create data collection forms that steal sensitive information. Successful exploitation of the import form CSRF vulnerability could result in the installation of malicious data collection forms on the target MuraCMS website that can steal sensitive user information. When an authenticated administrator visits a malicious webpage containing the CSRF exploit and selects the attacker-generated ZIP file, their browser uploads and installs form definitions that create legitimate forms that could be designed with malicious content.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceA CSRF vulnerability in MuraCMS versions up to 10.1.10 exists in the cForm.importform function, which lacks CSRF token validation. Attackers can craft malicious webpages that force authenticated administrators to upload and install attacker-controlled form definitions via ZIP files, enabling theft of sensitive user information.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE dataall versionsCVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify MuraCMS installationLocate MuraCMS by checking for its core directories (typically /core, /admin, /config) or the presence of index.cfm in the web root. Query the database or check the admin dashboard for product identification.Affected if MuraCMS is found to be installed on the server.
-
Determine MuraCMS versionAccess the admin dashboard and navigate to the About/Settings section to view the installed version. Alternatively, check version files in the /config directory or inspect the database for version metadata.Affected if The installed version is 10.1.10 or any earlier version (all versions up to 10.1.10 are affected).
-
Verify cForm module is enabledCheck if the cForm module is loaded by reviewing the active plugins/modules in MuraCMS admin under Site Settings > Modules, or inspect the /modules/ directory for cForm-related files.Affected if The cForm module is present and enabled in the MuraCMS installation.
-
Confirm importform function is accessibleTest access to the cForm.importform endpoint by attempting a request to the form import functionality via the admin interface or direct URL (typically /index.cfm/cform/importform). Check if the import ZIP functionality is exposed.Affected if The importform function is accessible without immediate CSRF token challenge.
-
Inspect CSRF protection on importformReview the source code of the cForm importform handler (usually in /modules/v1/cform/ or similar path). Search for CSRF token validation logic using functions like csrfVerify() or token validation routines. Inspect the form submission handler for token verification.Affected if No CSRF token validation is found in the importform function code or the token validation is bypassed/missing.
A user is affected if MuraCMS version 10.1.10 or earlier is installed with cForm module enabled and the importform function lacks CSRF token validation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataImplement CSRF token validation on the cForm.importform function and require valid tokens for all form import operations to prevent forged upload requests.
- Consultation3.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-55040 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-55040 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data