CVE-2025-46731

Published May 5, 2025

Last updated 2 months ago

Craft CMS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-46731 is a potential remote code execution vulnerability found in Craft CMS. The vulnerability exists in versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16. It is related to Twig Server-Side Template Injection (SSTI). To exploit this vulnerability, an attacker must have administrator access and the `ALLOW_ADMIN_CHANGES` setting must be enabled. Users are advised to update to patched versions 4.14.13 or 5.6.15 to mitigate the issue.

Description: Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-1336

Hype score: Not currently trending

References