PT-2025-19793 · Craft Cms · Craft Cms

Singetu0096 · Published 2024-11-13 · Updated 2025-05-14 · CVE-2025-46731

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.14.12 Craft CMS versions 5.0.0-RC1 through 5.6.15

Description Craft is a content management system that contains a potential remote code execution vulnerability via Twig SSTI. This issue can be exploited if an attacker has administrator access and the ALLOW ADMIN CHANGES option is enabled. It is estimated that around 23,000 devices may be affected. To mitigate the issue, users should update to the patched versions 4.14.13 or 5.6.15.

Recommendations For Craft CMS versions 4.0.0-RC1 through 4.14.12, update to version 4.14.13 to resolve the issue. For Craft CMS versions 5.0.0-RC1 through 5.6.15, update to version 5.6.15 to resolve the issue. As a temporary workaround, consider setting ALLOW ADMIN CHANGES to false in production to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Path traversal

Weakness Enumeration

CWE-94

CWE-22

CWE-1336

Related Identifiers

CVE-2025-46731

GHSA-7C58-G782-9J38

GHSA-F3CW-HG6R-CHFV

Affected Products

Craft Cms

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46731.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-46731 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7c58-g782-9j38 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f3cw-hg6r-chfv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52293 · Security Note
• http://github.com/craftcms/cms/pull/17026 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-46731 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-7c58-g782-9j38 · Note
• https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58 · Note
• https://reddit.com/r/CVEWatch/comments/1kg0pq8/top_10_trending_cves_06052025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1919504927480496563 · Twitter Post
• https://twitter.com/CVEnew/status/1919479831135453386 · Twitter Post
• https://t.me/latest_high_impact_cve/2275 · Telegram Post