The MuraCMS import form CSRF vulnerability allows an attacker to trick an authenticated administrator into uploading malicious form definitions because the import function does not enforce CSRF validation. A malicious website can forge a file‑upload request that, when the admin visits it, installs attacker‑controlled forms. These forms can be constructed to gather sensitive user data, effectively turning the CMS into a stealth data‑collection platform.

The vulnerability is present in MuraCMS versions up to 10.1.10, as indicated by the CPE string cpe:2.3:a:murasoftware:mura_cms. The vendor’s release notes for version 10.1.14 indicate that the issue was fixed. Only MuraCMS is affected; no other products appear to be impacted according to the available CNA data.

The CVSS score of 8.8 classifies this flaw as high severity, while an EPSS score below 1 % suggests that active exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog, so no confirmed active attacks are known. Exploitation requires an attacker to host a crafted webpage and deliver a ZIP file containing form definitions; once the administrator’s browser processes this request, the malicious forms are installed and can harvest sensitive data. Consequently, the risk to organizations with exposed or weakly protected admin sessions is moderate to high.