GHSA-7c58-g782-9j38 CVE-2025-46731
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 1.52%
- Chance of exploitation in the next 30 days. Higher than 74.56% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
- Fix
4.14.13- Upgrade craftcms/cms to this version or later
Description
Craft CMS contains a potential remote code execution vulnerability via Twig SSTI. You must have administrator access and ALLOW_ADMIN_CHANGES must be enabled for this to work.
https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production
Note: This is a follow-up to https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
Users should update to the patched versions (4.14.13 and 5.6.15) to mitigate the issue.
References
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| craftcms/cms | >= 4.0.0-RC1, < 4.14.13 |
4.14.13 |
| craftcms/cms | >= 5.0.0-RC1, < 5.6.15 |
5.6.15 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
craftcms/cms Packagist → 4.14.13
- composer
composer require craftcms/cms:^4.14.13
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
How to prevent it
- Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Implementation: Use the template engine's sandbox or restricted mode, if available.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7vrx-9684-xrf2 Craft CMS stores arbitrary content provided by unauthenticated users in session files | Medium Known exploited | Also affects craftcms/cms |
| GHSA-f3gw-9ww9-jmc3 Craft CMS Allows Remote Code Execution | Critical Known exploited | Also affects craftcms/cms |
| GHSA-x684-96hh-833x Craft CMS has a potential RCE with a compromised security key | High Known exploited | Also affects craftcms/cms |
| GHSA-2p6p-9rc9-62j9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | Critical Known exploited | Also affects craftcms/cms |
| GHSA-wg23-69c2-gjc8 Craft CMS: Passkey login accepts replayed WebAuthn assertions | Medium | Also affects craftcms/cms |
| GHSA-957r-qf9p-67xw Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts | Medium | Also affects craftcms/cms |
| GHSA-596p-6jv8-775v Craft CMS: Authenticated leak of secret environment variables | Medium | Also affects craftcms/cms |
| GHSA-xxpx-f366-4xpq Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element | Medium | Also affects craftcms/cms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor