CISA Flags Craft CMS Vulnerability CVE-2025

CVE-2024-56145 is an improper code-injection flaw (CWE-94) in Craft CMS that allows remote code execution over the network without authentication. The flaw is triggered on installations where the PHP configuration option `register_argc_argv` is enabled, a common setting, exposing an RCE vector to unauthenticated attackers. Successful exploitation gives attackers high-impact control over the host, with high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 9.3. Users of Craft CMS 3.x, 4.x, and 5.x prior to the fixed releases are affected; the flaw has been added to CISA's Known Exploited Vulnerabilities catalog (as of 2025-06-02), carries a 97.4% EPSS probability of exploitation within 30 days, and has a public proof-of-concept available.

Do: Upgrade Craft CMS to version 3.9.14, 4.13.2, or 5.5.2 as applicable to your major version. If upgrading is not immediately possible, set register_argc_argv=Off in php.ini and restart the PHP service to mitigate. Because the issue is in CISA's KEV catalog with active exploitation, check internet-facing Craft CMS instances for signs of compromise and apply required BOD 22-01 timelines if applicable.

Craft CMS contains a code injection flaw (CWE-94) in which the path used for database backups is not properly validated, allowing attacker-controlled input to be executed as code. An attacker who can influence the database-backup path — typically through an authenticated admin session or the utility that triggers a backup — can achieve remote code execution on the server running Craft CMS. Per CISA, the affected product is Craft CMS with no specific version range provided, so all deployments should be checked against the vendor's advisory for affected and fixed releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-02-20, confirming exploitation in the wild; EPSS assigns a 21.8% probability of exploitation within 30 days (97th percentile), no public proof-of-concept is known, and ransomware use is unconfirmed.

Do: Apply the vendor's patched release per Craft's security advisory, or follow CISA's required action to apply mitigations or discontinue use if mitigations are unavailable; verify your installed Craft CMS version against the vendor's affected-versions list. Until patched, restrict access to admin utilities that trigger database backups and review web/application logs for unusual backup-path activity or signs of compromise.