Critical · published April 25, 2025
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 We've got a mind-blowingly simple remote code execution vulnerability in Craft CMS! 🚨 This vulnerability is like a sneaky delivery driver who walks right into your house because the front door is wide open. It's a low-effort, high-reward situation for an attacker, as they can execute any command they want, directly on your server! If exploited, an attacker could unleash absolute devastation — they could manipulate your website, steal sensitive data, or even delete everything in sight. This isn’t just theoretical; this flaw is known to be actively exploited right now! 🔥
This vulnerability is like a sneaky delivery driver who walks right into your house because the front door is wide open. It's a low-effort, high-reward situation for an attacker, as they can execute any command they want, directly on your server! Craft CMS versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17 are vulnerable to a remote code execution flaw due to improper handling of user input. This means attackers can run arbitrary code on your server without needing authentication!
If exploited, an attacker could unleash absolute devastation — they could manipulate your website, steal sensitive data, or even delete everything in sight. This isn’t just theoretical; this flaw is known to be actively exploited right now! 🔥 Update Craft CMS immediately to versions 3.9.15, 4.14.15, or 5.6.17 to close this gaping hole. If you're using an earlier version, patch it now, and consider reviewing your security measures to prevent future risks. 🛡️ You've got this! Follow these steps, and you'll have your Craft CMS locked down tighter than a drum in no time! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| craftcms/craft_cms | ≥ 3.0.0, < 3.9.15 | 3.9.15 |
| craftcms/craft_cms | ≥ 4.0.0, < 4.14.15 | 4.14.15 |
| craftcms/craft_cms | ≥ 5.0.0, < 5.6.17 | 5.6.17 |