CVE-2024-56145

CVE-2024-56145 is an improper code-injection flaw (CWE-94) in Craft CMS that allows remote code execution over the network without authentication. The flaw is triggered on installations where the PHP configuration option `register_argc_argv` is enabled, a common setting, exposing an RCE vector to unauthenticated attackers. Successful exploitation gives attackers high-impact control over the host, with high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 9.3. Users of Craft CMS 3.x, 4.x, and 5.x prior to the fixed releases are affected; the flaw has been added to CISA's Known Exploited Vulnerabilities catalog (as of 2025-06-02), carries a 97.4% EPSS probability of exploitation within 30 days, and has a public proof-of-concept available.

What to do: Upgrade Craft CMS to version 3.9.14, 4.13.2, or 5.5.2 as applicable to your major version. If upgrading is not immediately possible, set register_argc_argv=Off in php.ini and restart the PHP service to mitigate. Because the issue is in CISA's KEV catalog with active exploitation, check internet-facing Craft CMS instances for signs of compromise and apply required BOD 22-01 timelines if applicable.