PT-2026-1343 · Pixel & Tonic · Craft

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-68436

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft versions 5.0.0-RC1 through 5.8.20 Craft versions 4.0.0-RC1 through 4.16.16

Description Craft is a platform for creating digital experiences. Authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo through maliciously crafted requests.

Recommendations Update to version 5.8.21 Update to version 4.16.17

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-68436

GHSA-53VF-C43H-J2X9

Affected Products

Craft

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68436.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-53vf-c43h-j2x9 · Vendor Advisory
• https://github.com/craftcms/cms/commit/4bcb0db554e273b66ce3b75263a13414c2368fc9 · Patch
• https://osv.dev/vulnerability/GHSA-53vf-c43h-j2x9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68436 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68436 · Security Note
• https://github.com/craftcms/cms · Note
• https://twitter.com/VulmonFeeds/status/2008404959532888471 · Twitter Post
• https://t.me/CVEtracker/41435 · Telegram Post
• https://twitter.com/CVEnew/status/2008346554143588439 · Twitter Post