PT-2026-1193 · Craft · Craft

Published 2026-01-04 · Updated 2026-01-06 · CVE-2025-68456

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Craft versions 5.0.0-RC1 through 5.8.20 Craft versions 3.0.0 through 4.16.16

Description Unauthenticated users can initiate database backup operations through certain administrative actions. This could lead to resource exhaustion or information disclosure.

Recommendations Update to Craft version 5.8.21. Update to Craft version 4.16.17. Craft 3 users should update to the latest Craft 4 and 5 releases.

Exploit

Fix

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-202

CWE-770

Related Identifiers

CVE-2025-68456

GHSA-V64R-7WG9-23PR

Affected Products

Craft

References · 12

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68456.json · Exploit
• https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68456 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68456 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v64r-7wg9-23pr · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 · Note
• https://t.me/CVEtracker/41439 · Telegram Post
• https://twitter.com/CVEnew/status/2008346548086992990 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008407519350149359 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2007757761095053823 · Twitter Post