# CVE-2024-56145: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Source: https://junglewise.ai/threats/cve-2024-56145-craft-cms-code-injection-in-php-register-argc-argv-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-18. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2024-56145 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2024-12-18

Craft CMS, a popular platform for building and managing websites, contains a critical security flaw that allows unauthorized individuals to take full control of the server. This vulnerability is being actively exploited in the wild and can lead to complete data theft, website defacement, or the installation of ransomware. Organizations are at risk if their web server configuration allows specific command-line arguments to be registered as global variables.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms), [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Craft CMS](https://junglewise.ai/threats/vendors/craft-cms), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2024-56145 exploited in the wild?** Yes. CVE-2024-56145 is known to be exploited in the wild, first recorded on 2 June 2025. Treat it as urgent.

**How severe is CVE-2024-56145?** Critical severity, with a CVSS score of 3.1, published 18 December 2024.

**Which products and versions are affected?** craftcms/cms (Packagist) ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.5.2.

**Is there a fix for CVE-2024-56145?** Yes. craftcms/cms (Packagist): upgrade to 5.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-56145 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-56145?** Check whether you run Craft CMS or craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.5.2 or later

  ```sh
  composer require craftcms/cms:^5.5.2
  ```


## Technical details

Craft CMS is vulnerable to remote code execution (RCE) via code injection (CWE-94). The vulnerability is exploitable if the PHP environment has the 'register_argc_argv' directive enabled in php.ini, which allows an attacker to pass malicious arguments through web requests that are then processed by the application. This is a network-based attack requiring no authentication or user interaction. CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Patches are available in versions 3.9.14, 4.13.2, and 5.5.2; a primary mitigation for those unable to upgrade is to disable 'register_argc_argv' in the PHP configuration.

## Affected products

- Pixel & Tonic Craft CMS 3.0.0 to 3.9.13, 4.0.0 to 4.13.1, 5.0.0 to 5.5.1

## Identifiers

- CVE-2024-56145
- GHSA-2p6p-9rc9-62j9

## Timeline

- 2024-12-18: disclosed: Initial disclosure by GitHub/Vendor
- 2024-12-18: patched: Fixes released in versions 3.9.14, 4.13.2, and 5.5.2
- 2025-06-02: kev added: CISA added to Known Exploited Vulnerabilities catalog
- 2025-06-02: exploited: Confirmed active exploitation in the wild

## Related threats

- [Craft CMS SQL injection in getNext/getPrev methods](https://junglewise.ai/threats/cve-2026-123489-craft-cms-4-0-0-before-4-18-9-and-5-0-0-before-5-11-2-contains-a)
- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)