CVE-2025-57811
📋 TL;DR
This CVE describes a remote code execution vulnerability in Craft CMS via Twig Server-Side Template Injection (SSTI). Attackers can execute arbitrary code on affected systems by injecting malicious templates. This affects Craft CMS versions 4.0.0-RC1 through 4.16.5 and 5.0.0-RC1 through 5.8.6.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, access sensitive data, install malware, or pivot to other systems.
Likely Case
Unauthorized access to application data, defacement, or installation of web shells for persistent access.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though RCE risk remains.
🎯 Exploit Status
SSTI vulnerabilities are commonly exploited and weaponization is likely given the RCE nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.16.6 and 5.8.7
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
Restart Required: Yes
Instructions:
1. Backup your Craft CMS installation and database. 2. Update Craft CMS to version 4.16.6 (for Craft 4) or 5.8.7 (for Craft 5). 3. Clear template caches. 4. Restart your web server.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and output encoding for all user-controlled template inputs.
WAF Rule Implementation
allDeploy web application firewall rules to detect and block SSTI payloads.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy application-level monitoring for suspicious template execution patterns
🔍 How to Verify
Check if Vulnerable:
Check your Craft CMS version in the admin panel or via composer show craftcms/cmsCheck Version:
composer show craftcms/cms | grep versionVerify Fix Applied:
Confirm version is 4.16.6 or higher (for Craft 4) or 5.8.7 or higher (for Craft 5)📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious template file modifications
- Unexpected system command execution in logs
Network Indicators:
- HTTP requests containing Twig template injection payloads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND ("{{.*}}" OR "{% .* %}" OR "{# .* #}") AND status=200