CVE-2025-68454
📋 TL;DR
This vulnerability allows authenticated remote code execution in Craft CMS via Twig Server-Side Template Injection. Attackers with administrator access (or non-administrators with access to System Messages utility) can execute arbitrary code on the server. Affects Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Authenticated attackers with admin privileges or System Messages access achieve remote code execution, potentially leading to data theft or system takeover.
If Mitigated
With allowAdminChanges disabled and proper access controls, risk is limited to authorized administrators only.
🎯 Exploit Status
Exploitation requires authenticated access and specific conditions, but the vulnerability is well-documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.21 and 4.16.17
Vendor Advisory: https://github.com/craftcms/cms/security/advisories/GHSA-742x-x762-7383
Restart Required: No
Instructions:
1. Backup your Craft CMS installation and database. 2. Update Craft CMS to version 5.8.21 (for Craft 5) or 4.16.17 (for Craft 4). 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable allowAdminChanges
allSet allowAdminChanges to false in config/general.php to prevent admin changes in production environments.
In config/general.php: 'allowAdminChanges' => false
Restrict System Messages Access
allLimit access to System Messages utility to trusted administrators only.
🧯 If You Can't Patch
- Disable allowAdminChanges in production environments immediately.
- Implement strict access controls and monitor for suspicious admin activity.
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version via Control Panel → Utilities → System Report or by examining composer.json.Check Version:
php craft --versionVerify Fix Applied:
Confirm version is 5.8.21 or higher (for Craft 5) or 4.16.17 or higher (for Craft 4).📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity, especially in System Messages or Settings sections
- Suspicious Twig template modifications
Network Indicators:
- Unusual outbound connections from Craft CMS server
SIEM Query:
source="craft.log" AND ("System Messages" OR "Settings" OR "Twig") AND ("modif*" OR "exec*" OR "shell*")