CVE-2025-55046
Published: 18 March 2026
Summary
CVE-2025-55046 is a high-severity CSRF (CWE-352) vulnerability in Murasoftware Mura Cms. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires mechanisms such as CSRF tokens to protect session authenticity, directly preventing forged requests to the cTrash.empty function.
SI-10 mandates validation of information inputs including CSRF tokens at endpoints like cTrash.empty, blocking unauthorized forged requests.
SI-2 ensures timely identification, reporting, and patching of the specific CSRF flaw lacking token validation in MuraCMS.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing CMS directly enables T1190 exploitation leading to T1485 data destruction via forged delete requests.
NVD Description
MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge requests…
more
that irreversibly delete all trashed content when an authenticated administrator visits a crated webpage. Successful exploitation of the CSRF vulnerability results in potentially catastrophic data loss within the MuraCMS system. When an authenticated administrator visits a malicious page containing the CSRF exploit, their browser automatically submits a hidden form that permanently empties the entire trash system without any validation, confirmation dialog, or user consent.
Deeper analysisAI
CVE-2025-55046 is a Cross-Site Request Forgery (CSRF) vulnerability affecting MuraCMS through version 10.1.10. The issue resides in the cTrash.empty function, which lacks CSRF token validation. This allows attackers to forge requests that permanently delete all content stored in the trash system, leading to irreversible data loss without any confirmation or user consent.
The vulnerability can be exploited by unauthenticated attackers over the network with low complexity, requiring only user interaction from an authenticated administrator. An attacker crafts a malicious webpage containing a hidden form that, when visited by the admin, automatically submits a request to empty the entire trash. Successful exploitation results in high integrity and availability impacts, as scored at CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), enabling catastrophic data loss in the MuraCMS instance.
Mitigation details are available in the MuraCMS v10 release notes at https://docs.murasoftware.com/v10/release-notes/#section-version-1014, which cover version 10.1.14, and on the official site at https://www.murasoftware.com. Security practitioners should upgrade to a patched version beyond 10.1.10 to address the missing CSRF protections.
Details
- CWE(s)