A cross‑site request forgery flaw in the bundle creation routine of MuraCMS allows an attacker to tempt administrators into generating and saving site bundles that contain highly sensitive content. The vulnerability is such that the bundle creation operation runs silently without the administrator’s awareness, and the resulting archives are placed in publicly accessible web directories, exposing information such as user accounts, password hashes, form submissions, email lists, plugins, and full site contents. Because the attacker does not need any credentials to trigger the action, the impact is potentially complete data theft for the site owner.

The flaw exists in MuraSoftware’s MuraCMS up to and including version 10.1.10. All installations of those releases are affected, regardless of site content size or configuration, since the vulnerable bundle‑creation endpoint is present in the default distribution.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score below 1% suggests the vulnerability is not widely exploited yet. It is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been documented. Nonetheless, the attack vector is an unauthenticated CSRF request, which can be performed simply by luring a logged‑in administrator to a crafted URL. Because the data is dumped to a public directory, the discovery of exfiltrated content is straightforward, and the loss of confidentiality can be catastrophic. The risk is therefore significant if an attacker can reach the targeted website’s frontend.