GitHub Advisoryadvisory · Packagist

GHSA-crcq-738g-pqvc Craft CMS Potential Remote Code Execution via Twig SSTI

MEDIUM Published 2025-08-25 Modified 2025-11-27 Official page ↗
Aliases
CVE-2025-57811
Ecosystem
Packagist
Packages
craftcms/cms
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-1336, CWE-22, CWE-94
Reviewed
2025-08-25

Affected packages

• Packagist craftcms/cms: >= 4.0.0-RC1, < 4.16.6 → fixed in 4.16.6 • Packagist craftcms/cms: >= 5.0.0-RC1, < 5.8.7 → fixed in 5.8.7

Description

Note that users must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against Craft CMS' recommendations for any non-dev environment. https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production Note: This is a follow-up to GHSA-f3cw-hg6r-chfv Users should update to the patched versions (4.16.6 and 5.8.7) to mitigate the issue. Resources: https://github.com/craftcms/cms/pull/17612

Related

Alias · CVE (1)

  • CVE-2025-57811 Craft is a platform for creating digital experiences. vulnerability

Weakness · CWE (3)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-94 Improper Control of Generation of Code weakness

References