Executive brief
Craft CMS, a popular platform for building and managing websites, contains a critical security flaw that allows unauthorized individuals to take full control of the server. This vulnerability is being actively exploited in the wild and can lead to complete data theft, website defacement, or the installation of ransomware. Organizations are at risk if their web server configuration allows specific command-line arguments to be registered as global variables.
Technical details
Craft CMS is vulnerable to remote code execution (RCE) via code injection (CWE-94). The vulnerability is exploitable if the PHP environment has the 'register_argc_argv' directive enabled in php.ini, which allows an attacker to pass malicious arguments through web requests that are then processed by the application. This is a network-based attack requiring no authentication or user interaction. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Patches are available in versions 3.9.14, 4.13.2, and 5.5.2; a primary mitigation for those unable to upgrade is to disable 'register_argc_argv' in the PHP configuration.
Affected products
- Pixel & Tonic Craft CMS 3.0.0 to 3.9.13, 4.0.0 to 4.13.1, 5.0.0 to 5.5.1
Timeline
- 2024-12-18: disclosed: Initial disclosure by GitHub/Vendor
- 2024-12-18: patched: Fixes released in versions 3.9.14, 4.13.2, and 5.5.2
- 2025-06-02: kev added: CISA added to Known Exploited Vulnerabilities catalog
- 2025-06-02: exploited: Confirmed active exploitation in the wild