PT-2026-1345 · Craft · Craft

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-68454

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft versions 5.0.0-RC1 through 5.8.20 Craft versions 4.0.0-RC1 through 4.16.16

Description Craft is susceptible to authenticated Remote Code Execution (RCE) through a Twig Server-Side Template Injection (SSTI). Successful exploitation requires administrator access to the Craft Control Panel with allowAdminChanges enabled, which is not recommended for non-development environments. Alternatively, a non-administrator account with access to the System Messages utility can be used if allowAdminChanges is disabled. A malicious payload can be crafted using the Twig map filter in text fields that accept Twig input within the Settings section of the Craft Control Panel or through the System Messages utility, potentially leading to RCE.

Recommendations Update to version 5.8.21 Update to version 4.16.17

Exploit

Fix

RCE

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2025-68454

GHSA-742X-X762-7383

Affected Products

Craft

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68454.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383 · Vendor Advisory
• https://github.com/craftcms/cms/commit/d82680f4a05f9576883bb83c3f6243d33ca73ebe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68454 · Security Note
• https://osv.dev/vulnerability/GHSA-742x-x762-7383 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68454 · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 · Note
• https://twitter.com/VulmonFeeds/status/2008399839566954603 · Twitter Post
• https://t.me/CVEtracker/41437 · Telegram Post
• https://twitter.com/CVEnew/status/2008346551312408809 · Twitter Post