CVEvulnerability

CVE-2025-68455

8.6 HIGH Published 2026-01-05 Modified 2026-10-07 Official page ↗
Status
Analyzed
Published
2026-01-05
Last modified
2026-10-07
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-470

Description

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for this to work. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue.

Affected configurations

• craftcms craft cms (>= 4.0.0.1 < 4.16.17) • craftcms craft cms (>= 5.0.1 < 5.8.21) • craftcms craft cms 4.0.0 • craftcms craft cms 5.0.0

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References