CVE-2025-55040:

MuraCMS through version 10.1.10 contains a CSRF vulnerability in the form import function, allowing attackers to upload and install malicious form definitions.

The CSRF vulnerability in MuraCMS's form import feature presents a significant security risk. Attackers can exploit this flaw by creating a malicious webpage that, when visited by an authenticated administrator, automatically generates and submits a ZIP file containing harmful form definitions. These definitions can then be used to create seemingly legitimate forms on the target website, potentially leading to the collection of sensitive user data. The attack requires user interaction, as the administrator must select the malicious ZIP file, but the process can be largely automated through the exploit page. This vulnerability underscores the importance of implementing proper CSRF protections in web applications, especially for sensitive administrative functions.