Is CVE-2024-56145 exploited in the wild?

Yes. CVE-2024-56145 is known to be exploited in the wild, first recorded on 2 June 2025. Treat it as urgent.

How severe is CVE-2024-56145?

Critical severity, with a CVSS score of 3.1, published 18 December 2024.

Which products and versions are affected?

craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.5.2.

Is there a fix for CVE-2024-56145?

Yes. craftcms/cms (Packagist): upgrade to 5.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-56145 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-56145?

Check whether you run Craft CMS or craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-56145: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

CVE-2024-56145 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2024-12-18

Craft CMS, a popular platform for building and managing websites, contains a critical security flaw that allows unauthorized individuals to take full control of the server. This vulnerability is being actively exploited in the wild and can lead to complete data theft, website defacement, or the installation of ransomware. Organizations are at risk if their web server configuration allows specific command-line arguments to be registered as global variables.

Technologies: Craft CMS, craftcms/cms (Packagist). Vendors: Craft CMS, Packagist.

Quick answers

Is CVE-2024-56145 exploited in the wild?: Yes. CVE-2024-56145 is known to be exploited in the wild, first recorded on 2 June 2025. Treat it as urgent.
How severe is CVE-2024-56145?: Critical severity, with a CVSS score of 3.1, published 18 December 2024.
Which products and versions are affected?: craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.5.2.
Is there a fix for CVE-2024-56145?: Yes. craftcms/cms (Packagist): upgrade to 5.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-56145 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-56145?: Check whether you run Craft CMS or craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.5.2 or later
```
composer require craftcms/cms:^5.5.2
```

Technical details

Craft CMS is vulnerable to remote code execution (RCE) via code injection (CWE-94). The vulnerability is exploitable if the PHP environment has the 'register_argc_argv' directive enabled in php.ini, which allows an attacker to pass malicious arguments through web requests that are then processed by the application. This is a network-based attack requiring no authentication or user interaction. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Patches are available in versions 3.9.14, 4.13.2, and 5.5.2; a primary mitigation for those unable to upgrade is to disable 'register_argc_argv' in the PHP configuration.

Affected products

Pixel & Tonic Craft CMS 3.0.0 to 3.9.13, 4.0.0 to 4.13.1, 5.0.0 to 5.5.1

Identifiers

CVE-2024-56145
GHSA-2p6p-9rc9-62j9

Timeline

2024-12-18: disclosed: Initial disclosure by GitHub/Vendor
2024-12-18: patched: Fixes released in versions 3.9.14, 4.13.2, and 5.5.2
2025-06-02: kev added: CISA added to Known Exploited Vulnerabilities catalog
2025-06-02: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.