CVE-2023-36260 is a high severity (7.5) denial of service report against the Feed Me plugin 4.6.1 for Craft CMS. NVD says the cause is saving a feed with no asset volume selected. It also records that a third party disputes the fix is security related. Update the plugin anyway.
What's affected
The record says Feed Me plugin 4.6.1 for Craft CMS is affected. It also notes that this is a report about the plugin, not about code in Craft CMS itself, so the Craft CMS product listing in the record can mislead.
The fix the record points to is a commit in the plugin's repository, described as fixing a PHP error that could occur when saving a feed using an Asset element type with no volume selected. In the changelog it appears under Unreleased, after 4.6.1.1, which was dated 24 March 2023. I did not find a named release for it in the pages I read.
The record carries a caveat. It says a third party states the commit has nothing to do with security. So whether this is a security vulnerability at all is disputed. Both statements are in the record, and I cannot settle the question from the sources. Check the plugin's current release notes for the first version that includes the change.
How to check if you're exposed
Feed Me is installed with Composer, so you can read the version from your project.
composer show craftcms/feed-me
That prints the installed version. You can also look in the Craft control panel under Settings, then Plugins, where the version is listed next to Feed Me.
If you manage several sites, run the command in each project, or search your lockfiles for craftcms/feed-me. Note that the plugin is only used when someone imports content, so a site that has it installed but never uses it still carries the code.
Also check who can create and save feeds. The record describes the trigger as crafted strings in the feed name and URL fields, which normally means someone with access to the feed settings.
What to do now
- Find every Craft project that uses craftcms/feed-me and note the version.
- Update the plugin to the latest 4.x release with Composer, then run any migrations Craft asks for.
- Read the plugin's changelog and confirm the update includes the fix for saving a feed with an Asset element type and no volume.
- Limit feed management permissions to people who need them.
- If a feed save fails with a server error after the update, check that each Asset feed has a volume selected.
- Remove the plugin from sites that no longer import content.
Why it matters
The record classes this as CWE-74, improper neutralization of special elements in output used by a downstream component, with a denial of service impact. The described trigger is odd. Crafted strings in the feed name and URL fields lead to a PHP error when a feed with an Asset element type and no volume is saved.
The score is 7.5, which reflects a network attack with no privileges and a high availability impact. That reading assumes the fields can be reached without signing in, which may not match how most Craft sites are set up. The dispute noted in the record adds further doubt about severity.
It is not on CISA's Known Exploited Vulnerabilities list, and nothing I read claims exploitation. This is a useful case study in how CVE records can overstate a bug. A PHP error on a save form is real and worth fixing, but it is not the same as an internet worm. Keep the plugin current, and read the evidence before you panic.
Try it yourself
Plugins live in your dependency tree, where they are easy to forget. This demo shows how a dependency inventory makes a plugin like this easy to find.
Click through it at your own pace, or open it full screen.
Quick check
Is this a real security vulnerability?
It is disputed. NVD records that a third party says the fix commit has nothing to do with security. Update the plugin anyway, since a crash on save is worth fixing.
Is Craft CMS itself affected?
No. The record says this is about the Feed Me plugin, not code provided by Craft CMS.
Sources
Last reviewed: 19 October 2026.
