BM Content Builder

BM Content Builder has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 7.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Path Traversal, behind 4 of the records (67%). Other recurring categories include Missing Authorization.

Every one of the 6 issues recorded for BM Content Builder has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (3) reported by Tonn.

Strategic Overview

Avg CVSSHigh

7.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all BM Content Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-1281

BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

6 records


2026-09-21 19:37	BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion BM Content Builder < 3.17.1	`CVE-2025-1281`	8.8 High	Tonn	Yes
2026-09-21 19:34	BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read BM Content Builder < 3.17.1	`CVE-2025-1280`	6.5 Medium	Tonn	Yes
2025-12-31 00:00	BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Download BM Content Builder < 3.16.3.3	`CVE-2025-69055`	6.5 Medium	Bonds	Yes
2025-09-23 00:00	BM Content Builder < 3.16.3.3 - Authenticated (Contributor+) Arbitrary File Deletion BM Content Builder < 3.16.3.3	`CVE-2025-59002`	8.1 High	Bonds	Yes
2025-06-05 00:00	BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save BM Content Builder <= 3.16.2.1	`CVE-2025-1777`	6.4 Medium	István Márton	Yes
2025-04-24 00:00	BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update BM Content Builder <= 3.16.2.1	`CVE-2025-1279`	8.8 High	Tonn	Yes

Showing 1–6 of 6 reports