CVE-2026-40325: 
MasaCMS vulnerability analysis and mitigation

CVE-2026-40325 is a Cross-Site Request Forgery (CSRF) vulnerability in Masa CMS's content restoration functionality, affecting versions 7.5.2 and earlier. The flaw exists in the cTrash.restore function, which fails to properly validate anti-CSRF tokens, allowing an attacker to trick a logged-in administrator into submitting a forged request that restores deleted content to attacker-controlled locations. Masa CMS is a content management system forked from Mura CMS, and this vulnerability is inherited from the upstream codebase. It was published on April 30, 2026, with fixed versions released concurrently. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) and a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is improper CSRF token validation (CWE-352) in the cTrash.restore function within the cTrash.cfc endpoint of Masa CMS. An attacker crafts a malicious webpage containing a forged POST request targeting this endpoint; when a logged-in administrator visits the page, their browser automatically submits the request with valid session credentials. The parentid parameter in the forged request allows the attacker to specify an arbitrary location in the site structure where the restored content will be placed. No authentication is required on the attacker's side — only the victim administrator must have an active session (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker (via a tricked administrator) to restore previously deleted content — including malicious scripts or outdated material — back into the live site, potentially reintroducing security or compliance risks. Sensitive documents stored in the trash can be moved into publicly accessible directories, resulting in unauthorized information disclosure. Additionally, the attacker can manipulate site navigation and structure by placing restored content in arbitrary locations, disrupting site integrity and potentially enabling further attacks if malicious content is restored to production (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.019% (0.000190), indicating a low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an authenticated administrator, which adds a meaningful barrier (GitHub Advisory).

1. Reconnaissance: Identify a target Masa CMS instance running version 7.5.2 or earlier. Confirm the presence of the administrative backend and identify a target administrator's email or identity for social engineering.
2. Craft malicious payload: Create an HTML page containing a hidden auto-submitting form that sends a POST request to the target's cTrash.cfc endpoint (e.g., https://target-site.com/index.cfm?method=cTrash.restore) with a chosen parentid parameter pointing to a publicly accessible location in the site structure.
3. Select target content: If possible, enumerate or infer the IDs of deleted content items in the trash that would be valuable to restore (e.g., previously deleted scripts or sensitive documents).
4. Deliver the malicious page: Send the attacker-controlled URL to the administrator via phishing email, social media, or another social engineering vector, enticing them to visit while logged into the CMS.
5. Trigger forged request: When the administrator visits the malicious page, their browser automatically submits the forged POST request with their active session cookies, bypassing CSRF protection.
6. Achieve objective: The cTrash.restore function processes the request without token validation, restoring the targeted deleted content to the attacker-specified parentid location — potentially making malicious content publicly accessible or exposing sensitive documents (GitHub Advisory).

• Network: Unexpected POST requests to cTrash.cfc or endpoints containing method=cTrash.restore originating from external referrers or with missing/mismatched Referer headers; POST requests to the CMS admin backend from IP addresses not associated with known administrators.
• Logs: CMS access logs showing cTrash.restore actions at unusual times or from unexpected IP addresses; content restoration events in the CMS audit log not correlated with known administrator activity.
• File System / CMS Content: Unexpected reappearance of previously deleted content in the live site structure; sensitive documents appearing in publicly accessible directories that were previously in the trash.
• Application Behavior: Changes to site navigation or structure not initiated by known administrators; content items appearing in locations inconsistent with normal editorial workflow (GitHub Advisory).

The Masa CMS team has released patches implementing mandatory CSRF token validation for all trash restoration actions. Users should upgrade to the following versions based on their branch: 7.2.x → 7.2.10, 7.3.x → 7.3.15, 7.4.x → 7.4.10, 7.5.x → 7.5.3. If an immediate upgrade is not feasible, recommended interim mitigations include: restricting access to the administrative backend via network controls or WAF rules (blocking suspicious POST requests to cTrash.cfc lacking a valid same-origin Referer header), using a dedicated or incognito browser for administrative sessions, ensuring administrators log out when not actively working, and regularly emptying the trash to minimize the pool of content available for unauthorized restoration (GitHub Advisory).