PT-2026-1346 · Craft · Craft

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-68455

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Craft versions 5.0.0-RC1 through 5.8.20 Craft versions 4.0.0-RC1 through 4.16.16

Description Craft is a platform for creating digital experiences. The software is susceptible to potential authenticated Remote Code Execution through malicious attached Behavior. An attacker must possess administrator access to the Craft Control Panel to exploit this issue.

Recommendations Update to version 5.8.21 Update to version 4.16.17

Exploit

Fix

RCE

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2025-68455

GHSA-255J-QW47-WJH5

Affected Products

Craft

References · 13

• 🔥 https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68455.json · Exploit
• https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593 · Patch
• https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef · Patch
• https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7 · Patch
• https://osv.dev/vulnerability/CVE-2025-68455 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-255j-qw47-wjh5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68455 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04 · Note
• https://twitter.com/CVEnew/status/2008346550129561608 · Twitter Post
• https://t.me/CVEtracker/41438 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2008410079112962202 · Twitter Post