CVE-2025-46731
📋 TL;DR
This CVE describes a server-side template injection (SSTI) vulnerability in Craft CMS that could allow remote code execution. The vulnerability requires administrator access and the ALLOW_ADMIN_CHANGES setting to be enabled. Users running Craft CMS 4.x before 4.14.13 or 5.x before 5.6.16 are affected.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attacker to execute arbitrary code, access sensitive data, and potentially pivot to other systems.
Likely Case
Privileged administrator with malicious intent or compromised admin account could execute arbitrary code on the server.
If Mitigated
No impact if ALLOW_ADMIN_CHANGES is disabled in production as recommended, or if patched versions are installed.
🎯 Exploit Status
Exploitation requires admin privileges and specific configuration setting enabled
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.14.13 or 5.6.16
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-7c58-g782-9j38
Restart Required: Yes
Instructions:
1. Backup your Craft CMS installation and database. 2. Update via Composer: composer require craftcms/cms:^4.14.13 (for 4.x) or composer require craftcms/cms:^5.6.16 (for 5.x). 3. Run any pending migrations. 4. Restart your web server.
🔧 Temporary Workarounds
Disable ALLOW_ADMIN_CHANGES
allSet ALLOW_ADMIN_CHANGES to false in production environment to prevent exploitation
Set ALLOW_ADMIN_CHANGES=false in your .env file or environment variables
🧯 If You Can't Patch
- Set ALLOW_ADMIN_CHANGES to false in production environment immediately
- Restrict admin access to trusted users only and monitor admin activity logs
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via composer show craftcms/cmsCheck Version:
composer show craftcms/cms | grep versionsVerify Fix Applied:
Verify version is 4.14.13+ or 5.6.16+ and ALLOW_ADMIN_CHANGES is false in production📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity, unexpected template modifications, suspicious PHP execution in logs
Network Indicators:
- Unusual outbound connections from web server, unexpected file uploads
SIEM Query:
source="craft-logs" AND (admin_activity OR template_modification) | where user_role="admin"