The cTrash.restore function in MuraCMS releases through version 10.1.10 accepts a parentid parameter without validating a CSRF token. This flaw allows a malicious site to issue a forged request that restores content from the trash to any parent location within the site hierarchy. When an authenticated administrator visits the attacker‑controlled page, the browser automatically submits the hidden form, bringing back deleted items into places chosen by the attacker. The result is that previously removed content—potentially malicious, sensitive, or non‑compliant material—can be re‑published, exposing confidential data, altering navigation, or re‑introducing outdated pages.

Vulnerable instances of MuraCMS up to and including version 10.1.10 are at risk. No specific vendor or product sub‑listing beyond MuraCMS is noted, but the CPE entry identifies the generic CMS product.

With a CVSS score of 8.8 the vulnerability is classified as high severity. The EPSS score is listed as less than 1 %, indicating that exploitation is not commonly observed in the wild, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector requires an authenticated administrator to load a malicious webpage; thus, user awareness and credential protection are critical. Once the crafted request is made, the attacker can redirect content to arbitrary parts of the site without further interaction.