Threat database

CVE-2025-68437 is a Server-Side Request Forgery (SSRF) vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20. It affects the GraphQL mutation `save_<VolumeName>_Asset` where the `_file` input's `url` parameter is not properly validated, allowing attackers to make the server fetch arbitrary remote resources.

EPSS 0.5%Vulnerabilitycraftcms#cwe-918Germany+7

CVE-2025-68436 is a medium-severity vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.16 and 5.0.0-RC1 through 5.8.20 that allows authenticated users to expose sensitive assets via their user profile photo through crafted requests. The flaw involves unauthorized exposure of sensitive information (CWE-200) without requiring user interaction or elevated privileges beyond authentication.

EPSS 0.3%Vulnerabilitycraftcms#cwe-200Germany+5

Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.

EPSS 0.9%Vulnerabilitycraftcms#cwe-1336Germany+7

Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-23209: "Craft CMS has a potential RCE with a compromised security key". To exploit this vulnerability, the project must meet these requirements: have a compromised security key and create an arbitrary file in Craft's /storage/backups folder. With those criteria in place, attackers could create a specific, malicious request to the /updater/restore-db endpoint and execute CLI commands remotely. This issue is fixed in versions 4.16.3 and 5.8.4.

EPSS 0.5%Vulnerabilitycraftcms#cwe-94Germany+9

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security key is affected. This vulnerability has been patched in Craft 5.5.8 and 4.13.8. Users who cannot update to a patched version, should rotate their security keys and ensure their privacy to help migitgate the issue.

KEVEPSS 21%Vulnerabilitycraftcms#cwe-94United States+11

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable `register_argc_argv` to mitigate the issue.

KEVEPSS 97%Vulnerabilitycraftcms#cwe-94United States+9