Threats affecting pkg:github/craftcms/cms

CVE-2025-68454 is a medium-severity vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20 that allows authenticated users to perform remote code execution (RCE) via Server-Side Template Injection (SSTI) in Twig templates. Exploitation requires administrator access with allowAdminChanges enabled or non-admin access with System Messages utility permissions.

CVE-2025-68437 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20. It affects the GraphQL mutation `save_<VolumeName>_Asset` where the `_file` input's `url` parameter is not properly validated, allowing attackers to make the server fetch arbitrary remote resources.

CVE-2025-68436 is a medium-severity vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20 that allows authenticated users to expose sensitive assets via their user profile photo through crafted requests. The flaw involves unauthorized exposure of sensitive information (CWE-200) without requiring user interaction or elevated privileges beyond authentication.

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.