CVE-2024-56145GHSA-2p6p-9rc9-62j9

Craft CMS Code Injection Vulnerability

Craft CMS Craft CMSPackagistApplications & CMS

CVSS

9.3Critical

ExploitationExploited in the wildAdded to KEV 2 Jun 2025CISA KEV

Exploit odds (EPSS)97.4%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in5.5.2Also 4.13.2, 3.9.14OSV

Federal deadline23 Jun 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

5.5.2craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^5.5.2"
4.13.2craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^4.13.2"
3.9.14craftcms/cms, PackagistOSVcomposer require "craftcms/cms:^3.9.14"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

18 Dec 2024, 20:37 UTCPublishedCVE List
19 Dec 2024Exploit code publicMetasploit
2 Jun 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

Exploit moduleCraft CMS Twig Template Injection RCE via FTP Templates Path 19 Dec 2024Metasploit
Scanner templateCraft CMS - Remote Code Execution via Template Path ManipulationNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has register_argc_argv enabled.

Text from CVE List

Affected versions 156

cmsaffected: >= 4.0.0-RC1, < 4.13.2CVE List
cmsaffected: >= 5.0.0-RC1, < 5.5.2CVE List
cmsaffected: >= 3.0.0, < 3.9.14CVE List
craftcms/cms, Packagistfrom 5.0.0-RC1, fixed in 5.5.2OSV
craftcms/cms, Packagist5.0.0OSV
craftcms/cms, Packagist5.0.0-RC1OSV
craftcms/cms, Packagist5.0.1OSV
craftcms/cms, Packagist5.0.2OSV
craftcms/cms, Packagist5.0.3OSV
craftcms/cms, Packagist5.0.4OSV
craftcms/cms, Packagist5.0.5OSV
craftcms/cms, Packagist5.0.6OSV
craftcms/cms, Packagist5.1.0OSV
craftcms/cms, Packagist5.1.1OSV
craftcms/cms, Packagist5.1.10OSV
craftcms/cms, Packagist5.1.2OSV
craftcms/cms, Packagist5.1.3OSV
craftcms/cms, Packagist5.1.4OSV
craftcms/cms, Packagist5.1.5OSV
craftcms/cms, Packagist5.1.6OSV
craftcms/cms, Packagist5.1.7OSV
craftcms/cms, Packagist5.1.8OSV
craftcms/cms, Packagist5.1.9OSV
craftcms/cms, Packagist5.2.0OSV
craftcms/cms, Packagist5.2.0-beta.1OSV
craftcms/cms, Packagist5.2.0-beta.2OSV
craftcms/cms, Packagist5.2.0-beta.3OSV
craftcms/cms, Packagist5.2.0-beta.4OSV
craftcms/cms, Packagist5.2.0-beta.5OSV
craftcms/cms, Packagist5.2.0-beta.6OSV
craftcms/cms, Packagist5.2.1OSV
craftcms/cms, Packagist5.2.10OSV
craftcms/cms, Packagist5.2.2OSV
craftcms/cms, Packagist5.2.3OSV
craftcms/cms, Packagist5.2.4OSV
craftcms/cms, Packagist5.2.4.1OSV
craftcms/cms, Packagist5.2.5OSV
craftcms/cms, Packagist5.2.6OSV
craftcms/cms, Packagist5.2.7OSV
craftcms/cms, Packagist5.2.8OSV
craftcms/cms, Packagist5.2.9OSV
craftcms/cms, Packagist5.3.0OSV
craftcms/cms, Packagist5.3.0-beta.1OSV
craftcms/cms, Packagist5.3.0-beta.2OSV
craftcms/cms, Packagist5.3.0.1OSV
craftcms/cms, Packagist5.3.0.2OSV
craftcms/cms, Packagist5.3.0.3OSV
craftcms/cms, Packagist5.3.1OSV
craftcms/cms, Packagist5.3.2OSV
craftcms/cms, Packagist5.3.3OSV
craftcms/cms, Packagist5.3.4OSV
craftcms/cms, Packagist5.3.5OSV
craftcms/cms, Packagist5.3.6OSV
craftcms/cms, Packagist5.4.0OSV
craftcms/cms, Packagistfrom 4.0.0-RC1, fixed in 4.13.2OSV
craftcms/cms, Packagist4.0.0OSV
craftcms/cms, Packagist4.0.0-RC1OSV
craftcms/cms, Packagist4.0.0-RC2OSV
craftcms/cms, Packagist4.0.0-RC3OSV
craftcms/cms, Packagist4.0.0.1OSV
craftcms/cms, Packagist4.0.1OSV
craftcms/cms, Packagist4.0.2OSV
craftcms/cms, Packagist4.0.3OSV
craftcms/cms, Packagist4.0.4OSV
craftcms/cms, Packagist4.0.5OSV
craftcms/cms, Packagist4.0.5.1OSV
craftcms/cms, Packagist4.0.5.2OSV
craftcms/cms, Packagist4.0.6OSV
craftcms/cms, Packagist4.1.0OSV
craftcms/cms, Packagist4.1.0.1OSV
craftcms/cms, Packagist4.1.0.2OSV
craftcms/cms, Packagist4.1.1OSV
craftcms/cms, Packagist4.1.2OSV
craftcms/cms, Packagist4.1.3OSV
craftcms/cms, Packagist4.1.4OSV
craftcms/cms, Packagist4.1.4.1OSV
craftcms/cms, Packagist4.10.0OSV
craftcms/cms, Packagist4.10.0-beta.1OSV
craftcms/cms, Packagist4.10.0-beta.2OSV
craftcms/cms, Packagist4.10.1OSV
craftcms/cms, Packagist4.10.2OSV
craftcms/cms, Packagist4.10.3OSV
craftcms/cms, Packagist4.10.4OSV
craftcms/cms, Packagist4.10.5OSV
craftcms/cms, Packagist4.10.6OSV
craftcms/cms, Packagist4.10.7OSV
craftcms/cms, Packagist4.10.8OSV
craftcms/cms, Packagist4.11.0OSV
craftcms/cms, Packagist4.11.0.1OSV
craftcms/cms, Packagist4.11.0.2OSV
craftcms/cms, Packagist4.11.1OSV
craftcms/cms, Packagist4.11.2OSV
craftcms/cms, Packagist4.11.3OSV
craftcms/cms, Packagist4.11.4OSV
craftcms/cms, Packagist4.11.5OSV
craftcms/cms, Packagist4.12.0OSV
craftcms/cms, Packagist4.12.1OSV
craftcms/cms, Packagist4.12.2OSV
craftcms/cms, Packagist4.12.3OSV
craftcms/cms, Packagist4.12.4OSV
craftcms/cms, Packagist4.12.4.1OSV
craftcms/cms, Packagist4.12.5OSV
craftcms/cms, Packagist4.12.6OSV
craftcms/cms, Packagist4.12.6.1OSV
craftcms/cms, Packagist4.12.7OSV
craftcms/cms, Packagistfrom 3.0.0, fixed in 3.9.14OSV
craftcms/cms, Packagist3.0.0OSV
craftcms/cms, Packagist3.0.0.1OSV
craftcms/cms, Packagist3.0.0.2OSV
craftcms/cms, Packagist3.0.1OSV
craftcms/cms, Packagist3.0.10OSV
craftcms/cms, Packagist3.0.10.1OSV
craftcms/cms, Packagist3.0.10.2OSV
craftcms/cms, Packagist3.0.10.3OSV
craftcms/cms, Packagist3.0.11OSV
craftcms/cms, Packagist3.0.12OSV
craftcms/cms, Packagist3.0.13OSV
craftcms/cms, Packagist3.0.13.1OSV
craftcms/cms, Packagist3.0.13.2OSV
craftcms/cms, Packagist3.0.14OSV
craftcms/cms, Packagist3.0.15OSV
craftcms/cms, Packagist3.0.16OSV
craftcms/cms, Packagist3.0.16.1OSV
craftcms/cms, Packagist3.0.17OSV
craftcms/cms, Packagist3.0.17.1OSV
craftcms/cms, Packagist3.0.18OSV
craftcms/cms, Packagist3.0.19OSV
craftcms/cms, Packagist3.0.2OSV
craftcms/cms, Packagist3.0.20OSV
craftcms/cms, Packagist3.0.21OSV
craftcms/cms, Packagist3.0.22OSV
craftcms/cms, Packagist3.0.23OSV
craftcms/cms, Packagist3.0.23.1OSV
craftcms/cms, Packagist3.0.24OSV
craftcms/cms, Packagist3.0.25OSV
craftcms/cms, Packagist3.0.26OSV
craftcms/cms, Packagist3.0.26.1OSV
craftcms/cms, Packagist3.0.27OSV
craftcms/cms, Packagist3.0.27.1OSV
craftcms/cms, Packagist3.0.28OSV
craftcms/cms, Packagist3.0.29OSV
craftcms/cms, Packagist3.0.3OSV
craftcms/cms, Packagist3.0.3.1OSV
craftcms/cms, Packagist3.0.30OSV
craftcms/cms, Packagist3.0.30.1OSV
craftcms/cms, Packagist3.0.30.2OSV
craftcms/cms, Packagist3.0.31OSV
craftcms/cms, Packagist3.0.32OSV
craftcms/cms, Packagist3.0.33OSV
craftcms/cms, Packagist3.0.34OSV
craftcms/cms, Packagist3.0.35OSV
craftcms/cms, Packagist3.0.36OSV
craftcms/cms, Packagist3.0.37OSV
craftcms/cms, Packagist3.0.38OSV
craftcms/cms, Packagist3.0.39OSV
craftcms/cms, Packagist3.0.4OSV